PT-2023-5165 · Microsoft · Azure Devops Server+1

Mikhail Shcherbakov + 1 · Published 2023-09-12 · Updated 2024-05-29 · CVE-2023-38155

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Azure DevOps Server (affected versions not specified) Team Foundation Server (affected versions not specified)

Description The vulnerability is related to the deserialization mechanism in Azure DevOps Server, specifically in the MachinePropertyBag class. It allows an attacker to execute arbitrary code due to insufficient validation of untrusted data. This issue can lead to local privilege escalation.

Recommendations For Azure DevOps Server, consider restricting access to the deserialization mechanism in the MachinePropertyBag class until a patch is available. For Team Foundation Server, restrict access to potentially vulnerable components to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2023-05757

CVE-2023-38155

ZDI-23-1403

Affected Products

Azure Devops Server

Team Foundation Server

References · 7

• https://zerodayinitiative.com/advisories/ZDI-23-1403 · Security Note
• https://bdu.fstec.ru/vul/2023-05757 · Security Note
• https://osv.dev/vulnerability/CVE-2023-38155 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38155 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38155 · Security Note
• https://t.me/cibsecurity/70321 · Telegram Post
• https://twitter.com/CVEnew/status/1701645458622259282 · Twitter Post