CVE-2024-43479: Microsoft Power Automate Desktop RCE Flaw

CVE-2024-43479 Overview

CVE-2024-43479 is a Remote Code Execution (RCE) vulnerability affecting Microsoft Power Automate Desktop for Windows. This vulnerability allows an attacker with low privileges to execute arbitrary code on affected systems through a network-based attack vector. The flaw stems from improper access control (CWE-284), enabling attackers to bypass security restrictions and gain unauthorized code execution capabilities within the Power Automate Desktop environment.

Microsoft Power Automate Desktop is a robotic process automation (RPA) tool widely used in enterprise environments to automate repetitive tasks and workflows. The presence of an RCE vulnerability in this component poses significant risk to organizations leveraging automation capabilities, as successful exploitation could lead to complete system compromise and lateral movement within corporate networks.

Critical Impact

Successful exploitation allows remote code execution with potential for complete system compromise, data exfiltration, and lateral movement across enterprise environments using Power Automate Desktop automation workflows.

Affected Products

• Microsoft Power Automate Desktop for Windows (all versions prior to security patch)
• Microsoft Power Automate (Windows platform builds)
• Enterprise deployments utilizing Power Automate Desktop automation

Discovery Timeline

• September 10, 2024 - CVE-2024-43479 published to NVD
• September 13, 2024 - Last updated in NVD database

Technical Details for CVE-2024-43479

Vulnerability Analysis

This Remote Code Execution vulnerability in Microsoft Power Automate Desktop arises from improper access control mechanisms within the application. The vulnerability requires network access and low-level privileges to exploit, though it does involve high attack complexity. The scope is changed (C), meaning successful exploitation can impact resources beyond the vulnerable component's security authority.

When exploited, the vulnerability enables an attacker to achieve high impacts across confidentiality, integrity, and availability. This indicates that an attacker could potentially read sensitive data processed by automation workflows, modify automated processes or inject malicious commands, and disrupt business-critical automation operations.

Root Cause

The root cause of CVE-2024-43479 is classified under CWE-284 (Improper Access Control). This weakness occurs when the software does not properly restrict access to resources from unauthorized actors. In the context of Power Automate Desktop, the improper access control allows attackers to bypass intended security restrictions and execute arbitrary code within the application's execution context.

The vulnerability likely exists in how Power Automate Desktop handles authentication or authorization for certain operations, allowing network-based attackers with minimal privileges to invoke functionality that should be restricted to higher-privileged users or trusted processes.

Attack Vector

The attack vector for CVE-2024-43479 is network-based, requiring the attacker to have network access to the target system running Power Automate Desktop. While the attack complexity is high (indicating specific conditions must be met), only low privileges are required, and no user interaction is necessary for exploitation.

An attacker could potentially exploit this vulnerability by sending specially crafted requests to the Power Automate Desktop service, bypassing access controls to achieve code execution. The changed scope indicates that successful exploitation could allow the attacker to affect resources outside the vulnerable application's security boundary, potentially impacting the underlying operating system or other applications.

For detailed technical information about the exploitation mechanism, refer to the Microsoft Security Response Center Advisory.

Detection Methods for CVE-2024-43479

Indicators of Compromise

• Unusual network connections originating from PAD.Console.Host.exe or related Power Automate Desktop processes
• Unexpected child processes spawned by Power Automate Desktop executables
• Anomalous automation workflow executions or modifications not initiated by authorized users
• Suspicious PowerShell or command-line activity associated with Power Automate Desktop services

Detection Strategies

• Monitor for unauthorized network traffic to/from Power Automate Desktop processes on unexpected ports
• Implement application-level logging for Power Automate Desktop to track workflow executions and modifications
• Deploy endpoint detection rules to identify code execution attempts originating from Power Automate Desktop components
• Correlate authentication logs with Power Automate Desktop activity to identify privilege abuse patterns

Monitoring Recommendations

• Enable detailed audit logging for Microsoft Power Automate Desktop installations
• Configure SIEM rules to alert on suspicious process creation chains involving Power Automate executables
• Monitor for changes to Power Automate Desktop configuration files or registry entries
• Implement network segmentation monitoring to detect lateral movement attempts following potential exploitation

How to Mitigate CVE-2024-43479

Immediate Actions Required

• Apply the Microsoft security update for Power Automate Desktop immediately
• Audit all Power Automate Desktop installations across the enterprise to identify vulnerable versions
• Review and restrict network access to systems running Power Automate Desktop
• Implement additional access controls and authentication requirements for Power Automate Desktop services

Patch Information

Microsoft has released a security update to address CVE-2024-43479. Organizations should apply the patch through their standard Microsoft update channels. The official security advisory with patch details is available at the Microsoft Security Response Center.

System administrators should prioritize patching based on the exposure of Power Automate Desktop installations, particularly those accessible from untrusted network segments or processing sensitive business data.

Workarounds

• Restrict network access to Power Automate Desktop services using firewall rules until patching is complete
• Implement additional authentication mechanisms for Power Automate Desktop operations where possible
• Consider temporarily disabling Power Automate Desktop on systems where it is not actively required
• Monitor affected systems with enhanced logging and detection until the security update is applied

# Verify Power Automate Desktop version for vulnerability assessment
# Check installed version via PowerShell
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" | Where-Object {$_.DisplayName -like "*Power Automate*"} | Select-Object DisplayName, DisplayVersion

# Review network connections from Power Automate processes
netstat -b | findstr -i "PAD"