CVE-2020-16904 Azure Functions Elevation of Privilege Vulnerability
An unauthenticated attacker can bypass access key validation to invoke HTTP Functions, leading to privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-16904?
CVE-2020-16904 is a medium-severity authentication bypass vulnerability in Microsoft Azure Functions, published on 16 Oct 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
<p>An elevation of privilege vulnerability exists in the way Azure Functions validate access keys.</p> <p>An unauthenticated attacker who successfully exploited this vulnerability could invoke an HTTP Function without proper authorization.</p> <p>This security update addresses the vulnerability by correctly validating access keys used to access HTTP Functions.</p>
Weakness: CWE-863
Which versions are affected by CVE-2020-16904?
It affects 1 product.
Products include Microsoft Azure Functions.
How do I fix CVE-2020-16904?
No fix has been published for CVE-2020-16904 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2020-16904 being exploited?
There is no known exploitation of CVE-2020-16904 in the wild and no public exploit code.
Other vulnerabilities in Microsoft Azure Functions
Sources
Also known as GHSA-v3gf-q256-843h.