Microsoft has recently disclosed multiple security vulnerabilities affecting its AI, cloud services, enterprise resource planning systems, and Partner Center solutions. Among the vulnerabilities identified is a critical flaw that has already been exploited in the wild, raising alarms within the cybersecurity community.
The most pressing concern is associated with a privilege escalation vulnerability known as CVE-2024-49035, which has been assigned a CVSS score of 8.7. This flaw, located in partner.microsoft.com, allows an unauthenticated attacker to gain elevated access to network privileges. The company’s advisory explicitly details that this vulnerability involves improper access control, making it particularly alarming given the potential for widespread exploitation.
In its report, Microsoft acknowledged the contributions of security researchers Gautam Peri, Apoorv Wadhwa, and an unnamed individual for their roles in identifying the flaw, although specific exploit details have not been disclosed. This transparency marks an ongoing commitment by Microsoft to address security weaknesses in its products.
The company is actively rolling out automatic updates to mitigate this vulnerability as part of enhancements to its online Microsoft Power Apps. In addition to CVE-2024-49035, Microsoft has addressed three other vulnerabilities, two classified as Critical and one as Important. One such flaw, CVE-2024-49038, scores a CVSS of 9.3 and involves cross-site scripting (XSS), which could allow unauthorized privilege escalation in Copilot Studio.
Another significant vulnerability, CVE-2024-49052, with a CVSS score of 8.2, reveals a lack of authentication for critical functions within Microsoft Azure PolicyWatch, exposing potential for unauthorized privilege escalation. Additionally, CVE-2024-49053, rated at 7.6, is a spoofing vulnerability affecting Microsoft Dynamics 365 Sales. This could enable an authenticated user to mislead another user into clicking a malicious link, subsequently directing them to a harmful site.
While Microsoft has already addressed most of these vulnerabilities, users are advised to update their Dynamics 365 Sales applications on Android and iOS systems to the latest version to ensure protection against the spoofing vulnerability.
This series of vulnerabilities exemplifies the evolving landscape of cybersecurity threats, where adversaries continually seek new avenues of exploit. The techniques likely employed in this incident could involve tactics outlined in the MITRE ATT&CK framework, such as initial access and privilege escalation. Business owners and IT professionals must remain vigilant, understanding that proactive measures are essential to safeguard sensitive data and maintain operational security.
For those interested in keeping abreast of the latest developments regarding data breaches and vulnerabilities, following platforms like Google News, Twitter, and LinkedIn is recommended for timely updates and insights.
