An improper access control vulnerability in the Azure Managed Instance for Apache Cassandra allows an authenticated attacker to elevate privileges over a network.
According to the CVSS metrics, successful exploitation of this vulnerability could lead to major loss of confidentiality (C:H) and major loss of integrity (I:H) but have no effect on availability (A:N). What does that mean for this vulnerability? Exploiting this vulnerability allows an attacker to view highly sensitive resource information (C:H) and results in a total loss of protection for that data (I:H), but does not provide the capability to impact resource availability. How could an attacker exploit this vulnerability? An attacker with permissions to deploy User Defined Functions (UDF) in an Azure Managed Instance for Apache Cassandra cluster can send specially crafted requests to the underlying host and extract credentials for managed identities of other clusters on the same host node. The compromised credentials enable the attacker to impersonate the victim's managed identity and retrieve information from other clusters hosted on the node which could be outside of the attacker's tenant.
<a href="https://twitter.com/wtm_offensi">wtm</a> with <a href="https://offensi.com/">Offensi</a>