CVE-2024-35255: Microsoft Authentication Library EoP Flaw

CVE-2024-35255 Overview

CVE-2024-35255 is an elevation of privilege vulnerability affecting Azure Identity Libraries and Microsoft Authentication Library (MSAL). This race condition vulnerability (CWE-362) allows a local attacker with low privileges to exploit a Time-of-Check Time-of-Use (TOCTOU) flaw in the authentication process, potentially gaining access to sensitive credential information and elevating their privileges on the affected system.

Critical Impact
A local attacker can exploit this race condition to access cached credentials and authentication tokens, potentially compromising Azure and Microsoft identity services across multiple programming language implementations.

Affected Products

Microsoft Authentication Library for Java, Node.js, and .NET
Microsoft Azure Identity SDK for Go, C++, .NET, Java, Python, and JavaScript
Applications utilizing affected versions of these authentication libraries

Discovery Timeline

June 11, 2024 - CVE-2024-35255 published to NVD
November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2024-35255

Vulnerability Analysis

This vulnerability stems from a race condition in how Azure Identity Libraries and Microsoft Authentication Library handle credential caching and token retrieval operations. The flaw allows a local attacker to exploit the timing window between when credentials are validated and when they are used, enabling unauthorized access to sensitive authentication data.

The vulnerability affects multiple implementations across various programming languages, indicating a design-level issue in the shared authentication logic rather than a language-specific implementation bug. This broad impact across Java, Node.js, .NET, Go, C++, Python, and JavaScript SDKs demonstrates the systemic nature of the vulnerability.

Root Cause

The root cause is a race condition (CWE-362) in the credential management subsystem. When the authentication libraries perform credential operations, there exists a time-of-check to time-of-use (TOCTOU) window where a local attacker can intercept or manipulate the authentication flow. The lack of proper synchronization primitives or atomic operations during credential handling creates this exploitable timing gap.

Attack Vector

The attack requires local access to the system where the vulnerable authentication libraries are deployed. An attacker with low-level privileges can exploit the race condition by:

Monitoring the authentication library's credential operations
Timing their attack to coincide with the vulnerable window between credential validation and usage
Intercepting or accessing cached credentials during this timing gap
Using the obtained credentials to elevate privileges or access protected resources

The vulnerability can be exploited without user interaction, making it particularly dangerous in multi-user environments or systems where lower-privileged processes share the same credential cache.

Detection Methods for CVE-2024-35255

Indicators of Compromise

Unusual access patterns to Azure credential cache files or token storage locations
Unexpected process activity around MSAL or Azure Identity SDK file operations
Anomalous timing patterns in authentication library calls indicating exploitation attempts
Multiple rapid authentication requests from processes that shouldn't require frequent re-authentication

Detection Strategies

Monitor file system access to credential cache locations used by Azure Identity Libraries
Implement process monitoring to detect suspicious timing patterns during authentication operations
Deploy endpoint detection rules to identify race condition exploitation attempts targeting authentication libraries
Review application logs for authentication anomalies or unexpected credential access patterns

Monitoring Recommendations

Enable detailed logging for Azure Identity SDK and MSAL operations in production environments
Configure SentinelOne to monitor for suspicious process interactions with authentication library components
Implement file integrity monitoring on credential cache directories
Set up alerts for unusual privilege escalation attempts following authentication library operations

How to Mitigate CVE-2024-35255

Immediate Actions Required

Inventory all applications using Azure Identity Libraries and Microsoft Authentication Library
Update to the latest patched versions of MSAL and Azure Identity SDK across all affected platforms
Review access controls on systems running applications that utilize these authentication libraries
Implement the principle of least privilege for processes that interact with Azure authentication

Patch Information

Microsoft has released security updates addressing this vulnerability. Refer to the Microsoft Security Advisory CVE-2024-35255 for specific version information and update guidance for each affected platform (Java, Node.js, .NET, Go, C++, Python, and JavaScript).

Update the following components to their latest secure versions:

Microsoft.Identity.Client (.NET)
@azure/identity (JavaScript/Node.js)
azure-identity (Python)
com.azure:azure-identity (Java)
Azure Identity SDK for Go and C++

Workarounds

Restrict local access to systems running applications that use affected authentication libraries
Implement additional access controls around credential cache storage locations
Consider implementing application-level locking mechanisms around authentication operations where feasible
Monitor for exploitation attempts while planning patching activities

bash

# Example: Update Azure Identity SDK for Python
pip install --upgrade azure-identity

# Example: Update Azure Identity SDK for JavaScript/Node.js
npm update @azure/identity

# Example: Update MSAL for .NET
dotnet add package Microsoft.Identity.Client --version [latest-secure-version]