CVE-2024-35267: Microsoft Azure DevOps Server XSS Vulnerability

CVE-2024-35267 Overview

CVE-2024-35267 is a spoofing vulnerability affecting Microsoft Azure DevOps Server. The flaw is tied to Cross-Site Scripting (XSS) weaknesses tracked under [CWE-79], allowing an authenticated attacker to inject content that spoofs trusted interface elements. Successful exploitation requires user interaction, such as clicking a crafted link or visiting a tampered project resource. Microsoft rates the confidentiality and integrity impact as high, with limited availability impact.

Critical Impact
An authenticated network attacker can spoof Azure DevOps Server content through crafted input, leading to high confidentiality and integrity impact when a victim interacts with the malicious payload.

Affected Products

Microsoft Azure DevOps Server 2022.1.0
On-premises Azure DevOps Server deployments running the affected release
Environments accessible over the network with low-privileged user access

Discovery Timeline

2024-07-09 - CVE-2024-35267 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-35267

Vulnerability Analysis

CVE-2024-35267 is a spoofing vulnerability in Azure DevOps Server rooted in Cross-Site Scripting behavior [CWE-79]. The application fails to properly neutralize user-supplied input before returning it in web responses. An attacker with valid low-privileged credentials can submit crafted content into fields that are later rendered to other users. When a victim interacts with the affected view, the payload executes in the victim's browser session under the Azure DevOps origin.

The issue produces spoofed interface elements that appear legitimate to project members, administrators, and reviewers. Because Azure DevOps handles source code, pipelines, and release artifacts, exploitation can facilitate credential theft, session token exposure, or manipulation of development workflows.

Root Cause

The root cause is improper output encoding of attacker-controlled data rendered within Azure DevOps Server web components. Input reaching a browser context is not consistently escaped, allowing script or markup to break out of intended containers. Microsoft's advisory categorizes this behavior under [CWE-79], the standard classification for XSS defects.

Attack Vector

Exploitation occurs over the network against an Azure DevOps Server instance. The attacker must first authenticate with low privileges, such as a contributor account on a shared project. The attacker then plants a crafted payload into a field, artifact, or work item that another user will view. User interaction is required for the payload to trigger. The vulnerability does not require administrative rights or local access, which broadens the pool of accounts that can weaponize it. Public exploit code is not currently listed, and the vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog.

Microsoft has not published detailed exploitation code. Refer to the Microsoft Security Update Guide for authoritative technical details.

Detection Methods for CVE-2024-35267

Indicators of Compromise

Work items, pull request descriptions, or repository content containing HTML tags such as <script>, <img onerror=...>, or encoded JavaScript URIs.
Unexpected outbound requests from user browsers to attacker-controlled domains shortly after accessing Azure DevOps pages.
Session tokens or personal access tokens (PATs) used from atypical geographic locations after a user viewed a shared work item.

Detection Strategies

Review Azure DevOps audit logs for creation or modification of work items, wikis, and pipeline definitions by low-privileged accounts.
Inspect stored content in projects for encoded script payloads and unusual markup added to user-editable fields.
Correlate authentication anomalies with recent user visits to specific Azure DevOps resources to identify potential session theft.

Monitoring Recommendations

Enable and forward Azure DevOps Server audit streams to a centralized SIEM for retention and correlation.
Alert on newly issued or reused PATs immediately following access to work items authored by non-standard accounts.
Monitor browser telemetry from privileged administrator workstations for script execution originating from Azure DevOps domains.

How to Mitigate CVE-2024-35267

Immediate Actions Required

Apply the security update referenced in the Microsoft Security Update Guide for Azure DevOps Server 2022.1.0.
Audit and revoke unused or overly permissive project memberships that grant write access to shared artifacts.
Rotate personal access tokens and session credentials for accounts that interacted with untrusted content prior to patching.

Patch Information

Microsoft has released a security update addressing CVE-2024-35267. Administrators should install the fix documented in the Microsoft Security Update Guide. Verify the Azure DevOps Server build number after installation to confirm the patched version is running.

Workarounds

Restrict contributor-level write access on sensitive projects until the patch is deployed.
Enforce Content Security Policy (CSP) headers at reverse proxies fronting Azure DevOps Server where feasible.
Train developers and reviewers to avoid clicking unexpected links or previewing untrusted work items during the exposure window.

bash

# Verify installed Azure DevOps Server version on Windows
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\TeamFoundationServer\17.0" | Select-Object InstalledEdition, Version

# Review recent work item edits by low-privileged users (example REST call)
curl -u user:PAT "https://devops.example.local/DefaultCollection/_apis/wit/workitems?api-version=7.0&$expand=all"