High
CVE-2024-20656
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
Add References:
CVE-2024-20656
MITRE ATT&CK
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Topic Tags
Description
Visual Studio Elevation of Privilege Vulnerability
Add Assessment
Ratings
-
Attacker ValueHigh
-
ExploitabilityVery High
Technical Analysis
CVE-2024-20656 is an elevation of privilege vulnerability in Microsoft Visual Studio, specifically in the Diagnostics Hub Standard Collector. This vulnerability, if exploited, allows an attacker to gain SYSTEM privileges on affected systems. Vulnerabilities like these are often observed being used in ransomware attacks.
This vulnerability concerns an issue with the VSStandardCollectorService150 service, which is used for diagnostic purposes in Visual Studio and runs in the NT AUTHORITY\SYSTEM context. The flaw was discovered by security researcher Filip Dragović, who also released a proof-of-concept (PoC) exploit code.
The exploit starts with the creation of a dummy directory where the VSStandardCollectorService150 writes files. The attacker then uses a series of manipulations involving junction directories and symbolic links, culminating in replacing a critical binary with a commandeered version to gain a SYSTEM shell.
To mitigate this issue, Microsoft released a patch as part of their Patch Tuesday updates. Users of Visual Studio are advised to apply the security update to prevent exploitation of this vulnerability. The update applies to all Visual Studio 2015 Update 3 editions except Build Tools.
Would you also like to delete your Exploited in the Wild Report?
Delete Assessment Only Delete Assessment and Exploited in the Wild ReportCVSS V3 Severity and Metrics
General Information
Vendors
- microsoft
Products
- visual studio 2015,
- visual studio 2017,
- visual studio 2019,
- visual studio 2022
References
Additional Info
Technical Analysis
Report as Emergent Threat Response
Report as Exploited in the Wild
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
