CVE-2024-29992

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

An information exposure vulnerability (CVE-2024-29992) has been identified in the Azure Identity library for .NET, distributed as the Azure.Identity NuGet package, which allows a local, low-privileged user to gain access to sensitive authentication credentials that the library did not sufficiently protect.

Per CWE-522: Insufficiently Protected Credentials, Insufficiently Protected Credentials is defined as a product transmitting or storing authentication credentials using an insecure method that is susceptible to unauthorized interception and/or retrieval.

This issue affects Azure.Identity versions prior to 1.11.0, which reaches NES for .NET 6.0 releases 6.0.0 through 6.0.41 transitively through the Microsoft.Extensions.Caching.SqlServer package graph.

‍

Details

Module Info

• Product: .NET
• Affected packages: Azure.Identity
• Affected versions: Azure.Identity < 1.11.0
• GitHub repository: https://github.com/Azure/azure-sdk-for-net
• Published packages: Download .NET (Linux, macOS, and Windows)
• Package manager: NuGet
• Fixed in: NES for .NET 6.0.42

Vulnerability Info

This Medium-severity vulnerability is found in the Azure.Identity package of the Azure Identity library for .NET. The library handled authentication credentials in a way that did not sufficiently protect them (CWE-522: Insufficiently Protected Credentials), so a local user with low privileges on the same host could read or intercept sensitive credential material without any user interaction. The impact is confined to confidentiality: an attacker gains access to credentials that could then be reused against Azure resources, but cannot directly modify data or affect availability through this flaw. Because Azure.Identity is an out-of-band NuGet package and is not part of the .NET shared framework, the exposure is opt-in: it is present only for applications that depend on Azure.Identity, including those that pull it transitively through the Microsoft.Extensions.Caching.SqlServer and Microsoft.Data.SqlClient package graph.

This vulnerability has been present since at least Azure.Identity 1.0 and likely earlier.

‍

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  
  • Azure.Identity >= 1.11.0
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.42 or later.

‍

Credits

• Microsoft (finder)