Improper Link Resolution Before File Access ('Link Following') (CWE-59)
Azure Network Watcher VM Agent has an elevation of privilege vulnerability. This vulnerability is associated with improper link resolution before file access, also known as 'link following'. It affects Azure Network Watcher Agent versions from 1.4.3320.1 up to, but not including, 1.4.3422.1 on Windows systems.
If exploited, this vulnerability could allow an attacker with low privileges to elevate their privileges on the system. The potential impact is severe, with high risks to confidentiality, integrity, and availability of the affected system. An attacker could potentially gain unauthorized access to sensitive information, modify system files, or disrupt system operations.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
A patch is available. Microsoft has released an update to address this vulnerability. The fixed version is 1.4.3422.1 or later of the Azure Network Watcher Agent.
To mitigate this vulnerability: 1. Update the Azure Network Watcher Agent to version 1.4.3422.1 or later immediately. 2. Implement the principle of least privilege, ensuring users and processes only have the minimum necessary permissions. 3. Monitor for suspicious activities related to privilege escalation or unauthorized file access. 4. Consider implementing additional access controls and monitoring on systems running Azure Network Watcher Agent. 5. Regularly review and update security configurations for Azure services and associated agents.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
A CVSS base score of 7.3 has been assigned.
Feedly found the first article mentioning CVE-2024-43470. See article
NVD published the first details for CVE-2024-43470
Feedly estimated the CVSS score as MEDIUM
Detection for the vulnerability has been added to Nessus (206900)
EPSS Score was set to: 0.04% (Percentile: 9.6%)
EPSS Score was set to: 0.05% (Percentile: 22.4%)