ZDI-24-985: Microsoft Azure Service Fabric servicefabricsdkstorage Uncontrolled Search Path Element Remote Code Execution Vulnerability
Published Jul 29, 2024
·Updated
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Service Fabric for Microsoft Azure. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8.
Affected Software
2 affected components
Microsoft Azure Service Fabric
Microsoft Service Fabric SDK Storage
Event History
Jul 29, 2024
Advisory Published
via ZDI·05:00 AM
Data Sourced
via ZDI·05:00 AM
Description
Frequently Asked Questions
1
What is the severity of ZDI-24-985?
ZDI-24-985 has been assigned a CVSS rating of 9.8, indicating critical severity.
2
What software is affected by ZDI-24-985?
ZDI-24-985 affects installations of Microsoft Azure Service Fabric.
3
Can ZDI-24-985 be exploited without authentication?
Yes, ZDI-24-985 can be exploited by remote attackers without requiring authentication.
4
What type of vulnerability is ZDI-24-985?
ZDI-24-985 is a remote code execution vulnerability.
5
How do I fix ZDI-24-985?
To fix ZDI-24-985, ensure that you apply the latest security updates provided by Microsoft for Azure Service Fabric.