Improper Link Resolution Before File Access ('Link Following') (CWE-59)
An elevation of privilege vulnerability exists in the Azure Connected Machine Agent. This vulnerability is associated with improper link resolution before file access, also known as 'link following'. The vulnerability has a CVSS v3.1 base score of 7.8, indicating a high severity level. It requires local access and low privileges to exploit, with no user interaction needed.
If successfully exploited, this vulnerability could allow an attacker to gain elevated privileges on the affected system. The potential impacts are severe, with high risks to confidentiality, integrity, and availability of the system. An attacker could potentially access sensitive information, modify system files, or disrupt system operations. Given the nature of Azure Connected Machine Agent, this could potentially affect cloud-connected systems, expanding the scope of the impact.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
A patch is available for this vulnerability. Microsoft released the patch on August 13, 2024. The vulnerability affects Azure Connected Machine Agent versions prior to 1.44. Security teams should prioritize updating to version 1.44 or later to mitigate this vulnerability.
1. Update Azure Connected Machine Agent to version 1.44 or later as soon as possible. 2. Implement the principle of least privilege, limiting user access rights to the minimum necessary for their job functions. 3. Monitor for suspicious activities related to file access and privilege escalation attempts. 4. Implement strong access controls and authentication mechanisms for local system access. 5. Regularly audit and review system configurations and permissions, especially those related to file access and symbolic links. 6. Consider implementing application whitelisting to prevent unauthorized executables from running. 7. Keep all systems and software up-to-date with the latest security patches, not just the Azure Connected Machine Agent.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
A CVSS base score of 7.8 has been assigned.
Feedly found the first article mentioning CVE-2024-38098. See article
NVD published the first details for CVE-2024-38098
EPSS Score was set to: 0.05% (Percentile: 19%)