medium

Synapse Analytics privilege escalation via intelligent caching

Published Thu, Mar 7th, 2024
Platforms

Summary

Tenable Research discovered a privilege escalation flaw that allows a user to escalate privileges to that of the root user within the context of a Spark VM. This escalation was achieved because of a permissions issue with scripts utilized by the intelligent caching service (AKA "Vegas") present in the environment.

Affected Services

Synapse Analytics

Remediation

None required

Tracked CVEs

No tracked CVEs

References

Entry Status
Finalized
Disclosure Date
Thu, Jan 25th, 2024
Exploitablity Period
September 2023 - January 2024
Known ITW Exploitation
-
Detection Methods
-
Piercing Index Rating
-
Discovered by
Jimi Sebree, Tenable

More vulnerabilities...

high

Azure Site Recovery privilege escalation

When the ASR service is enabled, it uses an Automation Account with a System-Assigned Managed Identity to manage Site Recovery extensions on VMs. However, the Runbook (a set of scripts for managing...

...
Joshua Murrell, NetSPI

medium

Azure HDInsight privilege escalation and DoS vulnerabilities

Three privilege escalation and denial-of-service vulnerabilities were discovered in Azure HDinsight, related to their usage of Apache Oozie and Ambari. The root cause of at least one of these vulne...

...
Lidor Ben Shitrit, Orca Sec...

high

Azure Devops Zero-Click CI/CD Vulnerability

Legit Security found a zero-click vulnerability in Azure Pipelines that allows an attacker to access secrets and internal information and perform actions in elevated permissions in the context of a...

...
Nadav Noy, Legit Security

View all