CVE-2019-1258 Azure Active Directory Authentication Library Elevation of Privilege Vulnerability
An authenticated attacker can exploit token caching flaws in Azure AD Authentication Library to perform actions as another user.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-1258?
CVE-2019-1258 is a high-severity vulnerability in Microsoft ADAL.NET, published on 14 Aug 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An elevation of privilege vulnerability exists in Azure Active Directory Authentication Library On-Behalf-Of flow, in the way the library caches tokens. This vulnerability allows an authenticated attacker to perform actions in context of another user. The authenticated attacker can exploit this vulneraiblity by accessing a service configured for On-Behalf-Of flow that assigns incorrect tokens. This security update addresses the vulnerability by removing fallback cache look-up for On-Behalf-Of scenarios.
Which versions are affected by CVE-2019-1258?
2 open source packages ship an affected version, including microsoft.identitymodel.clients.activedirectory. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
microsoft.identitymodel.clients.activedirectory NuGet | From 5.0.0 | 5.2.0 |
microsoft.identitymodel.clients.activedirectory NuGet | From 5.0.0 | 5.2.0 |
Products include Microsoft Active Directory Authentication Library, Microsoft Nuget.
How do I fix CVE-2019-1258?
Upgrade microsoft.identitymodel.clients.activedirectory to 5.2.0 or later.
Is CVE-2019-1258 being exploited?
There is no known exploitation of CVE-2019-1258 in the wild and no public exploit code.
Sources
Also known as GHSA-xc6x-cq47-9chw.