CVE-2024-35266 Overview
CVE-2024-35266 is a spoofing vulnerability in Microsoft Azure DevOps Server 2022.1.0. The flaw is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation), indicating a cross-site scripting condition that enables spoofing attacks against authenticated users.
An attacker with low privileges on the network can exploit this vulnerability when a user interacts with a crafted request or page. Successful exploitation compromises confidentiality and integrity of the affected instance and impacts availability to a limited degree.
Critical Impact
Authenticated attackers can spoof content within Azure DevOps Server, potentially harvesting session data, tokens, or repository content from users who interact with malicious payloads.
Affected Products
- Microsoft Azure DevOps Server 2022.1.0
- On-premises Azure DevOps deployments running the affected build
- Enterprise DevOps pipelines integrated with the vulnerable server
Discovery Timeline
- 2024-07-09 - CVE-2024-35266 published to the National Vulnerability Database
- 2024-07-09 - Microsoft published the Security Update Guide entry for CVE-2024-35266
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-35266
Vulnerability Analysis
The vulnerability arises from improper neutralization of user-supplied input rendered by Azure DevOps Server web pages. When the server processes attacker-controlled content, it fails to sanitize characters that carry meaning inside HTML or script contexts.
Exploitation requires an authenticated attacker with low-level access to submit crafted input to the server. A victim user must then interact with the affected resource, typically by loading a page or following a link.
Once the payload executes in the victim's browser context, the attacker can spoof legitimate interface elements. This behavior underpins the confidentiality and integrity impact scores associated with the vulnerability.
Root Cause
The root cause is missing or insufficient output encoding within an Azure DevOps Server web component. Input that traverses the server without proper contextual escaping reaches the browser, where it is interpreted as active content rather than data.
This defect maps to [CWE-79], a common class of stored or reflected cross-site scripting flaws in web applications.
Attack Vector
The attack vector is network-based and requires user interaction. An authenticated attacker plants a crafted payload in a location that renders inside another user's session, such as a work item field, comment, or pipeline artifact.
When the victim opens the affected page, the payload runs under the Azure DevOps Server origin. The attacker can then read privileged tokens, mimic UI elements to trick users into disclosing credentials, or manipulate repository data on behalf of the victim.
No public proof-of-concept exploit or CISA Known Exploited Vulnerabilities listing exists at the time of writing. Microsoft's Security Update Guide for CVE-2024-35266 is the authoritative technical reference.
Detection Methods for CVE-2024-35266
Indicators of Compromise
- Unexpected <script> tags, event handlers, or encoded HTML entities embedded in work item fields, pull request comments, wiki pages, or pipeline logs.
- Session tokens or authentication cookies leaving the environment via outbound requests originating from Azure DevOps Server web sessions.
- Newly created service connections, personal access tokens, or repository permissions altered shortly after users viewed suspicious content.
Detection Strategies
- Review Azure DevOps audit logs for anomalous edits to shared surfaces such as work items, wiki entries, and pipeline definitions.
- Inspect web server access logs for requests containing HTML or JavaScript metacharacters submitted to Azure DevOps Server endpoints.
- Correlate authentication events with unusual API activity that follows a user opening a shared work item or pull request.
Monitoring Recommendations
- Enable and forward Azure DevOps Server audit streams to a centralized SIEM for longitudinal analysis.
- Monitor egress traffic from browsers connected to the DevOps portal for beacons to unfamiliar external domains.
- Alert on personal access token creation and permission escalations that occur outside change-management windows.
How to Mitigate CVE-2024-35266
Immediate Actions Required
- Apply the Microsoft security update referenced in the Security Update Guide for CVE-2024-35266 to all Azure DevOps Server 2022.1.0 instances.
- Rotate personal access tokens, service connection secrets, and session cookies for any users who may have interacted with untrusted content.
- Audit recent administrative changes, pipeline modifications, and repository permission grants for signs of unauthorized activity.
Patch Information
Microsoft addressed CVE-2024-35266 through security updates for Azure DevOps Server 2022.1.0. Administrators should install the latest cumulative update published in the Microsoft Security Response Center advisory and validate the deployment against the version guidance in the Microsoft Security Update Guide.
Workarounds
- Restrict Azure DevOps Server access to authenticated users on trusted networks until patches are applied.
- Enforce least privilege on project contributors to reduce the pool of accounts that can plant hostile content.
- Educate users to avoid opening unexpected links, work items, or pull requests from unfamiliar contributors.
# Verify installed Azure DevOps Server version on the application tier
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Azure DevOps\Server" |
Select-Object -Property InstalledVersion, InstallPath
# Confirm the latest security update is present
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
