Improper Control of Generation of Code ('Code Injection') (CWE-94)
Azure CycleCloud Remote Code Execution Vulnerability. This vulnerability affects the integrity, availability, and confidentiality of the system, with all three having a HIGH impact. The attack vector is NETWORK, attack complexity is LOW, and it requires LOW privileges with NO user interaction. The scope is UNCHANGED.
This vulnerability could allow an attacker with low privileges to execute arbitrary code remotely on affected Azure CycleCloud systems. Successful exploitation could lead to unauthorized access to sensitive data, modification of system files or data, and potential disruption of services. Given the network attack vector and low attack complexity, this vulnerability could be exploited relatively easily by attackers, potentially leading to compromise of Azure CycleCloud environments.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
A patch is available. Microsoft has released an official fix for this vulnerability on September 10, 2024. The vulnerability affects Azure CycleCloud versions from 8.0.0 up to (but not including) 8.6.4.
1. Apply the official patch released by Microsoft as soon as possible. 2. Implement network segmentation to limit access to Azure CycleCloud systems. 3. Monitor for suspicious activities or unauthorized access attempts. 4. Ensure that the principle of least privilege is enforced for all user accounts. 5. Keep all Azure CycleCloud related software and dependencies up to date. 6. Implement strong authentication mechanisms for accessing Azure CycleCloud systems. 7. Regularly audit and review access logs for any signs of compromise.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Detection for the vulnerability has been added to Qualys (380468)
A CVSS base score of 8.8 has been assigned.
Feedly found the first article mentioning CVE-2024-43469. See article
NVD published the first details for CVE-2024-43469
Feedly estimated the CVSS score as HIGH
EPSS Score was set to: 0.05% (Percentile: 18.9%)
Detection for the vulnerability has been added to Nessus (207229)
EPSS Score was set to: 0.11% (Percentile: 45.8%)