Improper access control in Azure Managed Instance for Apache Cassandra - CVE-2024-38175
Published: August 22, 2024
Vulnerability identifier: #VU96455
CSH Severity: Medium
CVSS v4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-38175
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges on the system.
The vulnerability exists due to improper access restrictions. A remote authenticated user with permissions to deploy User Defined Functions (UDF) in an Azure Managed Instance for Apache Cassandra cluster can send specially crafted requests to the underlying host and extract credentials for managed identities of other clusters on the same host node.
The compromised credentials enable the attacker to impersonate the victim's managed identity and retrieve information from other clusters hosted on the node which could be outside of the attacker's tenant.
Affected software
Azure Managed Instance for Apache Cassandra
How to mitigate CVE-2024-38175
Install updates from vendor's website.
Azure Managed Instance for Apache Cassandra - update to 5.0