medium

Synapse Analytics privilege escalation via intelligent caching

Published Thu, Mar 7th, 2024

Platforms

azure

Summary

Tenable Research discovered a privilege escalation flaw that allows a user to escalate privileges to that of the root user within the context of a Spark VM. This escalation was achieved because of a permissions issue with scripts utilized by the intelligent caching service (AKA "Vegas") present in the environment.

Affected Services

Synapse Analytics

Remediation

None required

Tracked CVEs

No tracked CVEs

References

https://www.tenable.com/security/research/tra-2024-06

Entry Status

Finalized

Disclosure Date

Thu, Jan 25th, 2024

Exploitability Period

September 2023 - January 2024

Known ITW Exploitation

-

Detection Methods

None

Piercing Index Rating

-

Discovered by

Jimi Sebree, Tenable

More vulnerabilities...

high

Azure Site Recovery privilege escalation

azure

When the ASR service is enabled, it uses an Automation Account with a System-Assigned Managed Identity to manage Site Recovery extensions on VMs. However, the Runbook (a set of scripts for managing...

Joshua Murrell, NetSPI
medium

Azure HDInsight privilege escalation and DoS vulnerabilities

azure

Three privilege escalation and denial-of-service vulnerabilities were discovered in Azure HDinsight, related to their usage of Apache Oozie and Ambari. The root cause of at least one of these vulne...

Lidor Ben Shitrit, Orca Sec...
high

Azure Devops Zero-Click CI/CD Vulnerability

azuregithub

Legit Security found a zero-click vulnerability in Azure Pipelines that allows an attacker to access secrets and internal information and perform actions in elevated permissions in the context of a...

Nadav Noy, Legit Security
View all