CVE-2024-20676: Azure Storage Mover Remote Code Execution Vulnerability

Overview

Severity
High (CVSS 8)
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
Category
Remote Code Execution
Exploit Status
Not Exploited
Exploitation Likelihood
Less Likely
Patch Tuesday
2024-Jan
Released
2024-01-09
EPSS Score
0.17% (percentile: 37.7%)

FAQ

According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability? In this situation a successful exploit could let attacker gain access to the network where the agent is installed which could lead to accessing to other assets in that network. How could an attacker exploit this vulnerability? An attacker who has performed the exploit successfully would be able to gain access to the installed agent and could perform remote code execution. According to the CVSS metric, the attack complexity is high (AC:H) and the privileges required is high (PR:H). What does this mean for this vulnerability? For a successful exploitation, the attacker would need some key information like ARMID and UUID of the installed agent as pre-requisite.

Affected Products (1)

Azure

  • Azure Storage Mover Agent

Security Updates (1)

Acknowledgments

<a href="https://www.linkedin.com/in/shahar-zelig-931b5a82/">Shahar Zelig</a> with Microsoft, <a href="https://www.linkedin.com/in/oran-moyal-237821155/">Oran Moyal</a> with Microsoft

Revision History

  • 2024-01-09: Information published.