What’s Vulnerable › Vulnerabilities

CVE-2021-42855: Local privilege escalation due to misconfigured write permission on .debug_command.config file

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-03-10 · updated 2026-06-17
• Weakness: CWE-284

Description

It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent (DSA) uses the ".debug_command.config" file to store a json string that contains a list of IDs and pre-configured commands. The config file is subsequently used by the "/api/appInternals/1.0/agent/configuration" API to map the corresponding ID to a command to be executed.

Affected products

• Aternity SteelCentral AppInternals Dynamic Sampling Agent: from 11.0.0 before 11.8.8; from 12.0.0 before 12.13.0; 10.0.0 — fixed in 11.8.8, 12.13.0

How to fix

Upgrade to a fixed version: Aternity SteelCentral AppInternals Dynamic Sampling Agent 11.8.8, 12.13.0. Check the vendor advisory for mitigations.

References

• https://aternity.force.com/customersuccess/s/article/Local-privilege-escalation-due-to-misconfigured-write-permission-on-debug-command-config-file-CVE-2021-42855
• https://aternity.force.com/customersuccess/s/article/Local-privilege-escalation-due-to-misconfigured-write-permission-on-debug-command-config-file-CVE-2021-42855

Get alerted when CVE-2021-42855 or the next vulnerability affects your stack