CrowdStrike Falcon is a cloud-powered endpoint detection and response (EDR) and antivirus (AV) solution. On each end-device a kernel level managed sensor is deployed and makes use of the cloud-based capabilities. The sensor can be configured with an uninstall protection. It prevents the uninstallation of CrowdStrike Falcon sensor on the end-device without a one-time generated token.
Exploiting this vulnerability allows an attacker with administrative privileges to bypass the token check on Windows end-devices and to uninstall the sensor from the device without proper authorization, effectively removing the device's EDR and AV protection.
Vulnerable sensor version: 6.44.15806
Exploiting this vulnerability allows an attacker with administrative privileges to bypass the token check on Windows end-devices and to uninstall the sensor from the device without proper authorization, effectively removing the device's EDR and AV protection.
Vulnerable sensor version: 6.44.15806
GitHub - purplededa/CVE-2022-44721-CsFalconUninstaller
Contribute to purplededa/CVE-2022-44721-CsFalconUninstaller development by creating an account on GitHub.
github.com
