CVE-2024-35266
📋 TL;DR
This is a cross-site scripting (XSS) vulnerability in Azure DevOps Server that allows attackers to inject malicious scripts into web pages viewed by other users. It affects organizations using Azure DevOps Server on-premises, potentially compromising user sessions and data.
💻 Affected Systems
- Azure DevOps Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal authentication tokens, hijack user sessions, perform actions as authenticated users, and potentially access sensitive source code, build pipelines, and project data.
Likely Case
Attackers inject malicious scripts to steal session cookies or credentials, leading to unauthorized access to Azure DevOps projects and repositories.
If Mitigated
With proper input validation and output encoding, the risk is limited to isolated script execution without significant data compromise.
🎯 Exploit Status
Requires user interaction (victim must visit malicious page) but exploitation is straightforward once initial access is gained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Microsoft Security Update Guide for specific version
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35266
Restart Required: Yes
Instructions:
1. Download the latest security update from Microsoft Update Catalog
2. Apply the update to all Azure DevOps Server instances
3. Restart the server as required
4. Verify the update was successful
🔧 Temporary Workarounds
Enable Content Security Policy
allImplement CSP headers to restrict script execution from untrusted sources
Input Validation Enhancement
allAdd additional input validation for user-controllable data in Azure DevOps
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block XSS payloads
- Restrict user permissions to minimize impact if exploitation occurs
🔍 How to Verify
Check if Vulnerable:
Check Azure DevOps Server version against patched versions in Microsoft advisoryCheck Version:
Check Azure DevOps Server administration console or PowerShell: Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\DevDiv\AzureDevOps\Server' -Name VersionVerify Fix Applied:
Verify the installed version matches or exceeds the patched version from Microsoft📡 Detection & Monitoring
Log Indicators:
- Unusual script tags in request logs
- Suspicious JavaScript payloads in URLs or form submissions
Network Indicators:
- HTTP requests containing script injection patterns
- Unexpected external script loads
SIEM Query:
source="azure_devops" AND (http_request CONTAINS "<script>" OR http_request CONTAINS "javascript:")