CVE-2024-21638
Published: 10 January 2024
Summary
CVE-2024-21638 is a critical-severity Improper Privilege Management (CWE-269) vulnerability in Microsoft Azure Ipam. Its CVSS base score is 9.1 (Critical).
Operationally, ranked in the top 12.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-19276
Vulnerability details
Azure IPAM (IP Address Management) is a lightweight solution developed on top of the Azure platform designed to help Azure customers manage their IP Address space easily and effectively. By design there is no write access to customers' Azure environments…
more
as the Service Principal used is only assigned the Reader role at the root Management Group level. Until recently, the solution lacked the validation of the passed in authentication token which may result in attacker impersonating any privileged user to access data stored within the IPAM instance and subsequently from Azure, causing an elevation of privilege. This vulnerability has been patched in version 3.0.0.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Documented procedures ensure personnel are trained on authentication mechanisms, tangibly lowering the risk of improper authentication being exploited.
Training covers proper privilege management practices, making incorrect privilege assignments less likely.
Review helps detect improper privilege management by flagging unauthorized privilege changes or uses.
System recovery re-establishes trusted authentication processes following a compromise.
Centralized privilege assignment and oversight prevent ad-hoc or excessive privilege grants that occur when each system is configured independently.
Security-conscious enterprise architecture mandates authentication mechanisms and identity management at scale, mitigating improper authentication.
Documented procedures for role definition, privilege assignment, and removal provide the management framework that prevents improper privilege management.
Revoking authenticators and credentials eliminates the ability of terminated individuals to authenticate using prior mechanisms.