Skip to content
OpenAdvisories
High MSRC-CVE-2024-35255 1 CVE

Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability

Published Jun 11, 2024 · Updated Jun 13, 2024 · Revision 4

Summary

Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

What privileges could be gained by an attacker who successfully exploited the vulnerability?
An attacker who successfully exploited the vulnerability could elevate privileges and read any file on the file system with SYSTEM access permissions.

According to the CVSS metrics, successful exploitation of this vulnerability could lead to major loss of confidentiality (C:H), but lead to no loss of integrity (I:N) or availability (A:N). What does that mean for this vulnerability?
An attacker who successfully exploits this vulnerability can only obtain read access to the system files by exploiting this vulnerability. The attacker cannot perform write or delete operations on the files.

Which credential types provided by the Azure Identity client library are affected?
The vulnerability exists in the following credential types:
DefaultAzureCredential, ManagedIdentityCredential

Which credential types provided by the Microsoft Authentication Libraries are affected?
The vulnerability exists in the following credential types:
ManagedIdentityApplication (.NET), ManagedIdentityApplication (Java), ManagedIdentityApplication (Node.js)

Security updates
1.11.4 — https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/identity/Azure.Identity/CHANGELOG.md
1.15.1 — https://github.com/AzureAD/microsoft-authentication-library-for-java
1.6.0 — https://github.com/Azure/azure-sdk-for-go/blob/main/sdk/azidentity/CHANGELOG.md
4.61.3 — https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/blob/main/CHANGELOG.md
2.9.2 — https://github.com/AzureAD/microsoft-authentication-library-for-js#readme
1.12.2 — https://github.com/Azure/azure-sdk-for-java/blob/main/sdk/identity/azure-identity/CHANGELOG.md
4.2.1 — https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/CHANGELOG.md
1.8.0 — https://github.com/Azure/azure-sdk-for-cpp/blob/main/sdk/identity/azure-identity/CHANGELOG.md
1.16.1 — https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/identity/azure-identity/CHANGELOG.md

Vulnerabilities 1

Revision history

  1. #4

    Corrected Fixed Build Number and Download links in the Security Updates table. This is an informational change only.

  2. #3

    Added an FAQ. This is an information change only.

  3. #1

    Information published.

  4. #2

    In the Security Updates table, removed Microsoft Authentication Library (MSAL) for Python as it is not affected by CVE-2024-35255.

References