CVE-2024-21394: Microsoft Dynamics 365 XSS Vulnerability

CVE-2024-21394 Overview

CVE-2024-21394 is a spoofing vulnerability in Microsoft Dynamics 365 Field Service. Microsoft assigned this issue a CVSS 3.1 score of 7.6. The flaw is associated with CWE-79, Improper Neutralization of Input During Web Page Generation, indicating a cross-site scripting (XSS) condition. Successful exploitation allows an authenticated attacker to spoof content and impact confidentiality within another user's browser context. The scope is changed, meaning exploitation can cross security boundaries beyond the vulnerable component. Microsoft published the advisory as part of its February 2024 security update cycle.

Critical Impact
An authenticated attacker can craft malicious Field Service content that, when rendered by another user, executes in that user's session context and exposes sensitive data.

Affected Products

Microsoft Dynamics 365 (on-premises)
Microsoft Dynamics 365 Field Service module
Deployments matching cpe:2.3:a:microsoft:dynamics_365:*:*:*:*:on-premises:*:*:*

Discovery Timeline

2024-02-13 - CVE-2024-21394 published to the National Vulnerability Database
2024-02-13 - Microsoft released the security advisory and patch guidance
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2024-21394

Vulnerability Analysis

The vulnerability resides in how Dynamics 365 Field Service renders user-supplied input in the web interface. Attacker-controlled data is written into HTML output without adequate neutralization, enabling script or markup injection. Because the CVE is classified under CWE-79, the exploitation path aligns with stored or reflected cross-site scripting behavior. The changed scope indicates that injected content executes against a different security authority, typically the victim's authenticated Dynamics 365 session.

Exploitation requires low privileges to submit the malicious payload and user interaction from the victim to trigger it. Once triggered, the attacker can read session-bound data, forge trusted UI elements, and issue actions on behalf of the victim within Field Service workflows.

Root Cause

The root cause is improper output encoding in Field Service views that render fields such as work order notes, service task descriptions, or related user-editable text. When these fields are written into a page without contextual HTML, attribute, or JavaScript encoding, an attacker who can populate them injects executable markup.

Attack Vector

The attack vector is network-based over the Dynamics 365 web application. An authenticated attacker with permission to create or modify Field Service records inserts a crafted payload. A second Dynamics 365 user, typically a technician, dispatcher, or manager, opens the record. The malicious payload executes in that user's browser and inherits their session, exposing data and enabling limited integrity impact on rendered content.

No verified public proof-of-concept is available for this CVE. Refer to the Microsoft Security Update Guide for vendor-authored technical details.

Detection Methods for CVE-2024-21394

Indicators of Compromise

Field Service record fields containing HTML tags such as <script>, <iframe>, <svg onload=>, or encoded variants like <script>.
Outbound requests from Dynamics 365 user sessions to unfamiliar domains shortly after opening a Field Service work order.
Audit log entries showing record edits from low-privilege accounts followed by privileged actions from a viewer of that record.

Detection Strategies

Query the Dynamics 365 audit log for record updates containing angle brackets, javascript: URIs, or event-handler attributes in text fields.
Monitor browser Content Security Policy (CSP) violation reports originating from Field Service pages.
Correlate authentication and session activity across users viewing the same record to identify anomalous follow-on API calls.

Monitoring Recommendations

Ingest Dynamics 365 activity logs and web server logs into a centralized analytics platform for retention and query.
Alert on repeated writes to Field Service text fields from a single low-privilege account.
Track user-agent, IP, and session anomalies for accounts that recently rendered attacker-controlled records.

How to Mitigate CVE-2024-21394

Immediate Actions Required

Apply the Microsoft-provided update for Dynamics 365 as documented in the Microsoft Security Update Guide.
Inventory on-premises Dynamics 365 deployments and confirm the Field Service module version is patched.
Review recent Field Service record edits for injected HTML or script content and sanitize affected records.

Patch Information

Microsoft published remediation guidance for CVE-2024-21394 in the Microsoft Security Update Guide. Administrators should apply the vendor-specified update for the affected Dynamics 365 on-premises build. Cloud-hosted Dynamics 365 tenants receive updates through Microsoft's service maintenance channel.

Workarounds

Restrict Field Service record creation and edit privileges to trusted roles until patching completes.
Enforce a strict Content Security Policy on Dynamics 365 web endpoints to block inline script execution.
Train dispatchers and technicians to report unexpected UI behavior or rendered content when opening work orders.

bash

# Configuration example
# Review the Microsoft Security Update Guide for authoritative patch commands.
# https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21394