CVE-2024-35252: Azure Storage Data Movement Library DoS

CVE-2024-35252 Overview

CVE-2024-35252 is a denial of service vulnerability in the Microsoft Azure Storage Data Movement Library for .NET. The flaw allows a remote, unauthenticated attacker to disrupt availability of applications that depend on the library for transferring data to and from Azure Storage. Microsoft assigned this issue a CVSS 3.1 base score of 7.5 and categorized it under [CWE-1104] (Use of Unmaintained Third Party Components). The vulnerability requires no privileges and no user interaction, making it reachable across the network. The EPSS probability stands at 5.402% (90.288 percentile), reflecting elevated attention compared to most published CVEs.

Critical Impact
A network-based attacker can exhaust resources in applications using the Azure Storage Data Movement Library, halting cloud storage transfers and degrading dependent services.

Affected Products

Microsoft Azure Storage Data Movement Library for .NET
Applications and services embedding the library for Azure Blob, File, or Table transfers
Build pipelines and data migration tooling that rely on the library at runtime

Discovery Timeline

2024-06-11 - CVE-2024-35252 published to the National Vulnerability Database
2024-06-11 - Microsoft publishes security advisory for CVE-2024-35252
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-35252

Vulnerability Analysis

The Azure Storage Data Movement Library is a .NET client library used to perform high-performance uploads, downloads, and copies between Azure Storage endpoints. The library exposes asynchronous transfer APIs that consume network input and manage internal queues, buffers, and concurrency primitives. CVE-2024-35252 reflects a denial of service condition reachable through this network-facing surface. An attacker who can influence transfer input or interact with a service that brokers data movement operations can trigger conditions that exhaust availability without compromising confidentiality or integrity.

The CVSS impact metrics confirm an availability-only outcome: confidentiality and integrity remain unaffected, but the affected process can be rendered unresponsive. Workloads that wrap the library in long-running services, such as ingestion daemons or migration agents, are most exposed because a single induced failure can stall queued transfers and dependent business logic.

Root Cause

Microsoft classifies the underlying weakness as [CWE-1104], indicating reliance on a component whose handling of certain inputs or resource conditions does not enforce safe limits. The fix ships in updated library versions, suggesting the root cause is internal to the library's transfer or resource management logic rather than a misuse pattern by callers.

Attack Vector

The attack vector is network based, with low complexity, no privileges, and no user interaction required. An attacker reaches the vulnerable code path through data or operations processed by an application that uses the library. No public proof of concept, exploit, or in-the-wild activity has been reported, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploit code is available. Refer to the Microsoft Security Update Guide for CVE-2024-35252 for vendor-provided technical details.

Detection Methods for CVE-2024-35252

Indicators of Compromise

Repeated unhandled exceptions or process crashes originating from Microsoft.Azure.Storage.DataMovement assemblies
Sudden spikes in memory, thread, or handle counts in services that perform Azure Storage transfers
Stalled or repeatedly retried Azure Storage transfer jobs without corresponding service-side errors in Azure logs

Detection Strategies

Inventory all .NET applications, build agents, and migration utilities that reference the Microsoft.Azure.Storage.DataMovement NuGet package and compare versions against Microsoft's fixed releases.
Monitor application telemetry for abnormal termination of processes consuming the library, including .NET runtime exceptions linked to transfer operations.
Correlate Azure Storage diagnostic logs with client-side error rates to identify clients failing transfers at rates inconsistent with normal operations.

Monitoring Recommendations

Forward .NET application logs and Windows event logs from hosts running the library into a centralized analytics platform such as Singularity Data Lake for cross-host correlation.
Alert on process restarts, OOM conditions, and elevated thread counts on services that orchestrate Azure Storage transfers.
Track NuGet package versions during CI/CD builds and fail builds that pull pre-fix releases of the Data Movement Library.

How to Mitigate CVE-2024-35252

Immediate Actions Required

Upgrade the Microsoft.Azure.Storage.DataMovement NuGet package to the fixed version identified in the Microsoft Security Update Guide.
Rebuild and redeploy all applications, container images, and serverless packages that statically embed the vulnerable library version.
Restrict network reachability of services performing Azure Storage transfers to trusted clients and identities only.

Patch Information

Microsoft has released an updated version of the Azure Storage Data Movement Library that remediates CVE-2024-35252. Patch details and download links are available in the Microsoft Security Update Guide for CVE-2024-35252. Update the package reference in project files and verify the resolved assembly version at runtime.

Workarounds

Place the library behind authenticated, rate-limited interfaces so untrusted callers cannot directly influence transfer parameters.
Run transfer workloads in isolated processes or containers with resource limits and automatic restart policies to contain availability impact.
Implement client-side timeouts, circuit breakers, and retry budgets around Data Movement Library calls to prevent cascading service degradation.

bash

# Update the Azure Storage Data Movement Library to the patched version
dotnet add package Microsoft.Azure.Storage.DataMovement --version <patched-version>
dotnet restore
dotnet build -c Release