Privilege escalation in Azure Managed Instance for Apache Cassandra

1) Improper access control

EUVDB-ID: #VU96455

Risk: Medium

CVSSv4.0: 5.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-38175

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to improper access restrictions. A remote authenticated user with permissions to deploy User Defined Functions (UDF) in an Azure Managed Instance for Apache Cassandra cluster can send specially crafted requests to the underlying host and extract credentials for managed identities of other clusters on the same host node.

The compromised credentials enable the attacker to impersonate the victim's managed identity and retrieve information from other clusters hosted on the node which could be outside of the attacker's tenant.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Azure Managed Instance for Apache Cassandra: before 5.0

CPE2.3

• cpe:2.3:a:microsoft:azure_managed_instance_for_apache_cassandra:*:*:*:*:*:*:*:*

External links

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38175

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.