CyberRota Analysis
AI-GeneratedAn unprivileged attacker can exploit a permissions vulnerability in osquery prior to version 5.23.1 to read sensitive files during the file carving process, as in-progress carve directories lack private permissions. This could lead to unauthorized access to sensitive local files if the carve targets a directory controlled by the attacker. Organizations using osquery should prioritize upgrading to version 5.23.1 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Prior to 5.23.1, an unprivileged attacker can read the contents of an osquery file carve until the carve completes and the temporary files are deleted because in-progress carve directories are not created with private permissions. If the carve targets a directory that the attacker controls, arbitrary file reads are possible, such as sensitive local files. This issue is fixed in version 5.23.1.