CVE-2024-49060: Azure Stack HCI Privilege Escalation

CVE-2024-49060 Overview

CVE-2024-49060 is an elevation of privilege vulnerability in Microsoft Azure Stack HCI, the hyperconverged infrastructure platform used to run virtualized workloads on-premises. The flaw is associated with [CWE-798: Use of Hard-coded Credentials], allowing a local authenticated attacker to abuse embedded credentials to gain higher privileges on the affected host. Successful exploitation results in a scope change, granting the attacker high impact on confidentiality, integrity, and availability across components beyond the initially compromised one. Microsoft published the advisory on November 15, 2024, and the entry was last updated in the National Vulnerability Database (NVD) on January 23, 2025.

Critical Impact
A local authenticated attacker can leverage hard-coded credentials in Azure Stack HCI to escalate privileges and compromise the cluster host with high confidentiality, integrity, and availability impact.

Affected Products

Microsoft Azure Stack HCI
Microsoft Azure Stack HCI hyperconverged cluster nodes
Workloads hosted on affected Azure Stack HCI infrastructure

Discovery Timeline

2024-11-15 - Microsoft publishes the security advisory for CVE-2024-49060
2024-11-15 - CVE-2024-49060 published to the NVD
2025-01-23 - Last updated in the NVD database

Technical Details for CVE-2024-49060

Vulnerability Analysis

The vulnerability is classified under [CWE-798: Use of Hard-coded Credentials]. Hard-coded credentials embedded in software components allow attackers with local access to authenticate as a higher-privileged identity without obtaining secrets through legitimate means.

In Azure Stack HCI, an attacker who already holds low-privilege local access on a cluster node can use the embedded credentials to interact with management or platform components running with elevated rights. Because the attack changes the security scope, compromise of the initial low-privilege context extends to resources owned by other components, including hosted virtual machines and cluster services.

The attack requires local access and low privileges, with no user interaction. This profile is consistent with insider misuse, lateral movement from an already compromised tenant workload, or post-exploitation activity following an initial foothold on a management endpoint.

Root Cause

The root cause is the presence of hard-coded credentials within Azure Stack HCI components. Static secrets stored in binaries, configuration, or scripts cannot be rotated through normal credential management workflows and are accessible to any actor capable of reading the relevant artifacts on the host.

Attack Vector

Exploitation occurs over a local attack vector. The attacker authenticates to an Azure Stack HCI node with low privileges, extracts or invokes the hard-coded credential, and uses it to authenticate to a privileged interface or service. The resulting session operates outside the attacker's original security scope, enabling privilege escalation across the cluster.

No public proof-of-concept code, exploit module, or evidence of in-the-wild exploitation is recorded in CISA KEV or Exploit-DB at the time of writing. Refer to the Microsoft CVE-2024-49060 Advisory for vendor technical detail.

Detection Methods for CVE-2024-49060

Indicators of Compromise

Authentication events on Azure Stack HCI nodes using built-in or service accounts from interactive or unexpected local sessions.
Unexpected access to cluster management APIs, WMI, or PowerShell remoting endpoints from low-privileged user contexts.
New administrative actions on hosted virtual machines or cluster shared volumes that do not correlate with approved change tickets.

Detection Strategies

Audit Windows Security and Azure Stack HCI operational logs for logon events (Event IDs 4624, 4672) tied to platform service accounts originating from non-service processes.
Correlate process creation events (Event ID 4688) on cluster nodes with sudden privilege transitions or invocation of management cmdlets such as Get-ClusterNode, Invoke-Command, or Enter-PSSession by non-administrative users.
Monitor for credential material being read from disk or registry locations associated with Azure Stack HCI components.

Monitoring Recommendations

Forward Azure Stack HCI host telemetry, cluster logs, and Hyper-V audit events to a centralized SIEM or data lake for cross-node correlation.
Baseline normal administrative behavior per node and alert on deviations such as privilege escalation chains following low-privilege logons.
Track patch state of every node in the cluster and alert when an unpatched node continues to run in production.

How to Mitigate CVE-2024-49060

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2024-49060 Advisory to all Azure Stack HCI nodes.
Restrict local logon rights on cluster nodes to a minimal set of administrators and service accounts.
Review and rotate any credentials, certificates, or keys that may have been exposed to low-privileged users on affected hosts.
Audit recent privileged activity on Azure Stack HCI clusters to identify potential misuse prior to patching.

Patch Information

Microsoft has released a security update for Azure Stack HCI that addresses CVE-2024-49060. Administrators should consult the Microsoft CVE-2024-49060 Advisory for the specific build numbers and update packages applicable to their deployment, then deploy through standard Azure Stack HCI update workflows.

Workarounds

Enforce strict role-based access control on cluster nodes so that only trusted administrators can establish local sessions.
Isolate Azure Stack HCI management networks from general user and tenant workload networks to reduce the population of users with local access.
Increase logging verbosity on host operating systems and forward events off-box to preserve evidence if exploitation is attempted before patching completes.

bash

# Example: list installed updates on an Azure Stack HCI node to verify patch status
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20

# Example: enumerate local administrators on a cluster node for access review
Get-LocalGroupMember -Group "Administrators"