CVE-2024-35260: Microsoft Power Platform RCE Vulnerability

CVE-2024-35260 Overview

CVE-2024-35260 is an untrusted search path vulnerability affecting Microsoft Dataverse, a component of the Microsoft Power Platform. An authenticated attacker can exploit this flaw to execute arbitrary code over a network, potentially leading to complete system compromise. The vulnerability stems from improper handling of DLL loading paths, allowing attackers to inject malicious code into the application's execution flow.

Critical Impact

Successful exploitation allows authenticated attackers to achieve remote code execution on affected Microsoft Dataverse deployments, potentially compromising the confidentiality, integrity, and availability of enterprise data and connected systems.

Affected Products

• Microsoft Power Platform
• Microsoft Dataverse

Discovery Timeline

• June 27, 2024 - CVE-2024-35260 published to NVD
• February 3, 2025 - Last updated in NVD database

Technical Details for CVE-2024-35260

Vulnerability Analysis

This vulnerability is classified as CWE-426 (Untrusted Search Path), which occurs when an application searches for libraries or executables in directories that can be controlled or influenced by an attacker. In the context of Microsoft Dataverse, the application fails to properly validate or restrict the search path when loading dynamic-link libraries (DLLs) or other executable components.

The network-accessible nature of this vulnerability significantly increases its risk profile, as attackers can exploit it remotely without requiring local access to the target system. While authentication is required as a prerequisite, the low attack complexity means that once an attacker has valid credentials, exploitation is straightforward.

Root Cause

The root cause of CVE-2024-35260 lies in the improper implementation of DLL loading mechanisms within Microsoft Dataverse. When the application attempts to load required libraries, it searches through a predefined set of directories. If this search path includes directories where an attacker can place malicious files—such as user-writable folders, network shares, or current working directories—the attacker can introduce a malicious DLL that the application will load and execute with the privileges of the running process.

This type of vulnerability often arises from:

• Relative path usage instead of absolute paths for library loading
• Inadequate validation of library origins before loading
• Overly permissive directory permissions in the search path
• Missing Windows API security flags such as SetDllDirectory("") or SetDefaultDllDirectories()

Attack Vector

The attack vector for CVE-2024-35260 involves network-based exploitation by an authenticated attacker. The attack flow typically follows this pattern:

1. Initial Access: The attacker obtains valid authentication credentials for the Microsoft Dataverse environment
2. Reconnaissance: The attacker identifies directories in the DLL search path that are writable or controllable
3. Payload Deployment: A malicious DLL is placed in a location where it will be found before the legitimate library
4. Trigger Execution: The attacker triggers the vulnerable code path, causing Microsoft Dataverse to load the malicious DLL
5. Code Execution: The malicious code executes with the privileges of the Microsoft Dataverse process

This vulnerability does not require user interaction, meaning the attack can be fully automated once initial authentication is achieved. The potential impact includes complete compromise of the affected system's confidentiality, integrity, and availability.

Detection Methods for CVE-2024-35260

Indicators of Compromise

• Unexpected DLL files appearing in Microsoft Power Platform installation directories or user-writable paths
• Unusual process execution chains originating from Microsoft Dataverse components
• Network connections to unknown external hosts from Power Platform processes
• Authentication logs showing unusual access patterns to Dataverse environments

Detection Strategies

• Monitor DLL loading events using Windows Event Logging or Sysmon to identify libraries loaded from non-standard locations
• Implement application allowlisting to detect and block unauthorized executables and libraries
• Deploy endpoint detection and response (EDR) solutions to identify suspicious process behavior associated with DLL hijacking
• Analyze authentication logs for anomalous access patterns to Microsoft Power Platform resources

Monitoring Recommendations

• Enable enhanced logging for Microsoft Power Platform and Dataverse components
• Configure alerts for DLL loading events from user-writable directories
• Monitor for privilege escalation attempts following Dataverse authentication
• Implement file integrity monitoring on critical application directories

How to Mitigate CVE-2024-35260

Immediate Actions Required

• Review the Microsoft CVE-2024-35260 Advisory for the latest patching guidance
• Audit user access to Microsoft Power Platform and revoke unnecessary permissions
• Implement network segmentation to limit exposure of Dataverse services
• Enable enhanced monitoring for suspicious DLL loading activities

Patch Information

Microsoft has addressed this vulnerability through updates to the Microsoft Power Platform. As this is a cloud-hosted service, Microsoft manages the patching process. Organizations should verify with Microsoft that their Dataverse environments have received the security update by consulting the Microsoft Security Response Center advisory.

For on-premises or hybrid deployments, administrators should:

1. Check the Microsoft Security Update Guide for specific patch details
2. Apply all available security updates to Power Platform components
3. Verify successful patch application through version checks

Workarounds

• Restrict network access to Microsoft Dataverse services to trusted IP ranges only
• Implement strict least-privilege access controls for Power Platform users
• Enable additional authentication factors for Dataverse access
• Deploy host-based intrusion prevention systems to monitor for DLL hijacking attempts
• Consider using Windows Defender Application Control (WDAC) policies to restrict DLL loading

Organizations should prioritize applying the official Microsoft patch as the primary remediation strategy, using workarounds only as temporary measures until patching can be completed.