CVE-2024-38109
Server-Side Request Forgery (SSRF) (CWE-918)
Summary
An authenticated attacker can exploit a Server-Side Request Forgery (SSRF) vulnerability in Microsoft Azure Health Bot to elevate privileges over a network.
Impact
This vulnerability allows an authenticated attacker to potentially gain unauthorized access to sensitive information or execute unauthorized actions on behalf of the Azure Health Bot service. The impact is severe, with a CVSS base score of 8.8 (High). The vulnerability affects confidentiality, integrity, and availability, all rated as High. This indicates that an attacker could access sensitive data, modify data, and potentially disrupt the availability of the service.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. Microsoft has released an official fix for this vulnerability on August 13, 2024.
Mitigation
1. Apply the official patch released by Microsoft as soon as possible. 2. Implement network segmentation and access controls to limit potential SSRF attacks. 3. Monitor for suspicious network activity related to Azure Health Bot. 4. Ensure that authentication mechanisms are robust and regularly audited. 5. Consider implementing additional security measures such as Web Application Firewalls (WAF) to help detect and prevent SSRF attempts.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H/E:U/RL:O/RC:C
Timeline
Feedly found the first article mentioning CVE-2024-38109. See article
Feedly estimated the CVSS score as HIGH
A CVSS base score of 9.1 has been assigned.
NVD published the first details for CVE-2024-38109
CVE-2024-38109 is a critical elevation of privilege vulnerability affecting Azure Health Bot, with a CVSSv3 score of 9.1. The vulnerability was discovered by Tenable researcher Jimi Sebree and has been patched by Microsoft. No action is required for users, and there are no known proof-of-concept exploits or downstream impacts to other vendors or technologies. See article
EPSS Score was set to: 0.09% (Percentile: 40.8%)