CVE-2024-35255: Microsoft Authentication Library EoP Flaw

CVE-2024-35255 Overview

CVE-2024-35255 is an elevation of privilege vulnerability affecting Azure Identity Libraries and Microsoft Authentication Library (MSAL). This race condition vulnerability (CWE-362) allows a local attacker with low privileges to exploit a Time-of-Check Time-of-Use (TOCTOU) flaw in the authentication process, potentially gaining access to sensitive credential information and elevating their privileges on the affected system.

Critical Impact

A local attacker can exploit this race condition to access cached credentials and authentication tokens, potentially compromising Azure and Microsoft identity services across multiple programming language implementations.

Affected Products

• Microsoft Authentication Library for Java, Node.js, and .NET
• Microsoft Azure Identity SDK for Go, C++, .NET, Java, Python, and JavaScript
• Applications utilizing affected versions of these authentication libraries

Discovery Timeline

• June 11, 2024 - CVE-2024-35255 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2024-35255

Vulnerability Analysis

This vulnerability stems from a race condition in how Azure Identity Libraries and Microsoft Authentication Library handle credential caching and token retrieval operations. The flaw allows a local attacker to exploit the timing window between when credentials are validated and when they are used, enabling unauthorized access to sensitive authentication data.

The vulnerability affects multiple implementations across various programming languages, indicating a design-level issue in the shared authentication logic rather than a language-specific implementation bug. This broad impact across Java, Node.js, .NET, Go, C++, Python, and JavaScript SDKs demonstrates the systemic nature of the vulnerability.

Root Cause

The root cause is a race condition (CWE-362) in the credential management subsystem. When the authentication libraries perform credential operations, there exists a time-of-check to time-of-use (TOCTOU) window where a local attacker can intercept or manipulate the authentication flow. The lack of proper synchronization primitives or atomic operations during credential handling creates this exploitable timing gap.

Attack Vector

The attack requires local access to the system where the vulnerable authentication libraries are deployed. An attacker with low-level privileges can exploit the race condition by:

1. Monitoring the authentication library's credential operations
2. Timing their attack to coincide with the vulnerable window between credential validation and usage
3. Intercepting or accessing cached credentials during this timing gap
4. Using the obtained credentials to elevate privileges or access protected resources

The vulnerability can be exploited without user interaction, making it particularly dangerous in multi-user environments or systems where lower-privileged processes share the same credential cache.

Detection Methods for CVE-2024-35255

Indicators of Compromise

• Unusual access patterns to Azure credential cache files or token storage locations
• Unexpected process activity around MSAL or Azure Identity SDK file operations
• Anomalous timing patterns in authentication library calls indicating exploitation attempts
• Multiple rapid authentication requests from processes that shouldn't require frequent re-authentication

Detection Strategies

• Monitor file system access to credential cache locations used by Azure Identity Libraries
• Implement process monitoring to detect suspicious timing patterns during authentication operations
• Deploy endpoint detection rules to identify race condition exploitation attempts targeting authentication libraries
• Review application logs for authentication anomalies or unexpected credential access patterns

Monitoring Recommendations

• Enable detailed logging for Azure Identity SDK and MSAL operations in production environments
• Configure SentinelOne to monitor for suspicious process interactions with authentication library components
• Implement file integrity monitoring on credential cache directories
• Set up alerts for unusual privilege escalation attempts following authentication library operations

How to Mitigate CVE-2024-35255

Immediate Actions Required

• Inventory all applications using Azure Identity Libraries and Microsoft Authentication Library
• Update to the latest patched versions of MSAL and Azure Identity SDK across all affected platforms
• Review access controls on systems running applications that utilize these authentication libraries
• Implement the principle of least privilege for processes that interact with Azure authentication

Patch Information

Microsoft has released security updates addressing this vulnerability. Refer to the Microsoft Security Advisory CVE-2024-35255 for specific version information and update guidance for each affected platform (Java, Node.js, .NET, Go, C++, Python, and JavaScript).

Update the following components to their latest secure versions:

• Microsoft.Identity.Client (.NET)
• @azure/identity (JavaScript/Node.js)
• azure-identity (Python)
• com.azure:azure-identity (Java)
• Azure Identity SDK for Go and C++

Workarounds

• Restrict local access to systems running applications that use affected authentication libraries
• Implement additional access controls around credential cache storage locations
• Consider implementing application-level locking mechanisms around authentication operations where feasible
• Monitor for exploitation attempts while planning patching activities

# Example: Update Azure Identity SDK for Python
pip install --upgrade azure-identity

# Example: Update Azure Identity SDK for JavaScript/Node.js
npm update @azure/identity

# Example: Update MSAL for .NET
dotnet add package Microsoft.Identity.Client --version [latest-secure-version]