CVE-2024-35254: Azure Monitor Agent Elevation of Privilege Vulnerability
CVE-2024-35254 is an elevation of privilege vulnerability in Azure Monitor Agent, rated Important by Microsoft, with a CVSS 3.1 base score of 7.1 (High). An attacker can exploit it by an attacker with local access, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 0.83% probability of exploitation activity in the next 30 days, higher than 58% of all scored vulnerabilities. Microsoft released the fix on 11 June 2024 in the June 2024 Patch Tuesday. It affects 1 product in 1 product family (Azure).
Key facts
- CVE ID
- CVE-2024-35254
- Severity
- High CVSS 7.1
- Microsoft severity
- Important
- Impact
- Elevation of Privilege
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Less Likely
- Weakness
- CWE-59
- EPSS
- 0.83% (percentile 58%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- June 2024 Patch Tuesday
- Product families
- Azure
CVSS score and vector
Microsoft scores CVE-2024-35254 at 7.1 (temporal 6.2) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality impact | None |
| Integrity impact | High |
| Availability impact | High |
| Exploit code maturity | Unproven |
| Remediation level | Official fix |
| Report confidence | Confirmed |
Frequently asked questions (Microsoft)
What actions do customers need to take to protect themselves from this vulnerability?
Customers who have disabled Automatic Extension Upgrades or would like to upgrade an extension immediately must manually update their Azure Monitor Agent to the latest version. For more information on how to perform a manual update, see Manage Azure Monitor Agent.
How could an attacker exploit this vulnerability and what privileges could an attacker gain?
An authenticated attacker with read access permissions can exploit this vulnerability to perform arbitrary file and folder deletion on the host where the Azure Monitor Agent is installed.
According to the CVSS metrics, successful exploitation of this vulnerability could lead to no loss of confidentiality (C:N), but could lead to major loss on integrity (I:H) and availability (A:H). What does that mean for this vulnerability?
This vulnerability does not allow disclosure of any confidential information, but could allow an attacker to delete data that could include data that results in the service being unavailable.
Affected products (1)
Azure
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Azure Monitor Agent | Release Notes | Security Update | 1.26.0 | Maybe |
NIST NVD data
- NVD status
- Modified
- NVD CVSS
- 7.1 (HIGH)
- NVD weakness
- CWE-59
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| azure monitor agent | before 1.26.0 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35254 (Patch, Vendor Advisory)
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35254 (Patch, Vendor Advisory)
Acknowledgments
- R4nger & Zhiniang Peng
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. |