PT-2022-2477 · Microsoft+1 · Azure Data Factory+2

Published 2022-04-15 · Updated 2022-05-18 · CVE-2022-29972

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Magnitude Simba Amazon Redshift ODBC Driver versions 1.4.14 through 1.4.21.1001 Magnitude Simba Amazon Redshift ODBC Driver versions 1.4.22 through 1.4.x before 1.4.52 Microsoft Azure Synapse (affected versions not specified) Microsoft Azure Data Factory (affected versions not specified)

Description The issue is related to an argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Redshift ODBC Driver, which may allow a local user to execute arbitrary code. Additionally, there is a vulnerability in Microsoft Azure Synapse and Azure Data Factory that could have led to remote code execution attacks, allowing attackers to gain control of other Synapse workspaces and leak sensitive data, including Azure service keys and API tokens, as well as passwords for other services.

Recommendations For Magnitude Simba Amazon Redshift ODBC Driver versions 1.4.14 through 1.4.21.1001, update to a version outside of this range to mitigate the risk. For Magnitude Simba Amazon Redshift ODBC Driver versions 1.4.22 through 1.4.x before 1.4.52, update to version 1.4.52 or later to resolve the issue. For Microsoft Azure Synapse, restrict access to critical functions until a patch is available. For Microsoft Azure Data Factory, avoid using sensitive data, including Azure service keys and API tokens, in the affected component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability in Microsoft Azure Synapse and Azure Data Factory.

Fix

Missing Authentication

Argument Injection

Weakness Enumeration

CWE-306

CWE-88

Related Identifiers

BDU:2022-02884

CVE-2022-29972

Affected Products

Magnitude Simba Amazon Redshift Jdbc Driver

Azure Data Factory

Azure Synapse

References · 14

• https://msrc.microsoft.com/update-guide/vulnerability/ADV220001 · Vendor Advisory
• https://insightsoftware.com/trust/security/advisories/redshift-and-athena-driver-vulnerability · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29972 · Security Note
• https://bdu.fstec.ru/vul/2022-02884 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29972 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29972 · Vendor Advisory
• https://t.me/thehackernews/2169 · Telegram Post
• https://zerodayinitiative.com/blog/2022/5/10/the-may-2022-security-update-review · Note
• https://magnitude.com/products/data-connectivity · Note
• https://t.me/cibsecurity/42205 · Telegram Post
• https://t.me/my_cyde/536 · Telegram Post
• https://t.me/cibsecurity/42212 · Telegram Post
• https://t.me/poxek/1509 · Telegram Post
• https://msrc-blog.microsoft.com/2022/05/09/vulnerability-mitigated-in-the-third-party-data-connector-used-in-azure-synapse-pipelines-and-azure-data-factory-cve-2022-29972 · Note