Modzero disclosed a minor security issue in a CrowdStrike agent. The researchers did not want to participate in a bug bounty program. After some back-and-forth, they provided a draft advisory together with the poc. CrowdStrike could not reproduce the issue and did not provide a trial license to test the vulnerability with an updated agent. So, after finding a suitable test agent the researcher found that the vulnerability was detected on the latest version. However, they were able to circumvent the countermeasures with small adjustments to the exploit. CrowdStrike’s response, quoted by SecurityWeek, explains that the MSI uninstaller fails open when the custom action checking the uninstall token dies (CVE-2022-2841), and that a July 8 Tech Alert already credited modzero.
This underlines two key aspects. First, a lack of CVEs is not indicative of software quality. Many bug bounty reports are never published. This is also the second important aspect. Non-disclosure agreements restrict the flow of important information. Especially for information security, security through obscurity has proven bad practice many many times.