CVE-2024-38195HighCVSS 7.8

Azure CycleCloud Remote Code Execution Vulnerability

Published
August 13, 2024
Last Modified
—

🔗 CVE IDs covered (1)

CVE-2024-38195 →

📋 Description

How could an attacker exploit this vulnerability? An authenticated attacker with permissions to execute commands on the Azure CycleCloud instance could send a specially crafted request that returns the storage account credentials and runtime data. The attacker can then use the comprised credentials to access the underlying storage resources and upload malicious scripts which will be executed as Root, enabling remote code execution to be performed on any cluster in the CycleCloud instance.

🎯 Affected products16

  • Azure CycleCloud 8.0.0
  • Azure CycleCloud 8.0.1
  • Azure CycleCloud 8.0.2
  • Azure CycleCloud 8.1.0
  • Azure CycleCloud 8.1.1
  • Azure CycleCloud 8.2.0
  • Azure CycleCloud 8.2.1
  • Azure CycleCloud 8.2.2
  • Azure CycleCloud 8.3.0
  • Azure CycleCloud 8.4.0
  • Azure CycleCloud 8.4.1
  • Azure CycleCloud 8.4.2
  • Azure CycleCloud 8.5.0
  • Azure CycleCloud 8.6.0
  • Azure CycleCloud 8.6.1
  • Azure CycleCloud 8.6.2

✅ Remediation

KBRelease Notes (Security Update) — fixed build 8.6.3

🔗 References (3)