Attacker Value
High
(1 user assessed)
Exploitability
Very High
(1 user assessed)
User Interaction
None
Privileges Required
Low
Attack Vector
Local
2

CVE-2024-20656

Disclosure Date: January 09, 2024
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

Visual Studio Elevation of Privilege Vulnerability

Add Assessment

1
Ratings
Technical Analysis

CVE-2024-20656 is an elevation of privilege vulnerability in Microsoft Visual Studio, specifically in the Diagnostics Hub Standard Collector. This vulnerability, if exploited, allows an attacker to gain SYSTEM privileges on affected systems. Vulnerabilities like these are often observed being used in ransomware attacks.

This vulnerability concerns an issue with the VSStandardCollectorService150 service, which is used for diagnostic purposes in Visual Studio and runs in the NT AUTHORITY\SYSTEM context. The flaw was discovered by security researcher Filip Dragović, who also released a proof-of-concept (PoC) exploit code.

The exploit starts with the creation of a dummy directory where the VSStandardCollectorService150 writes files. The attacker then uses a series of manipulations involving junction directories and symbolic links, culminating in replacing a critical binary with a commandeered version to gain a SYSTEM shell.

To mitigate this issue, Microsoft released a patch as part of their Patch Tuesday updates. Users of Visual Studio are advised to apply the security update to prevent exploitation of this vulnerability. The update applies to all Visual Studio 2015 Update 3 editions except Build Tools.

CVSS V3 Severity and Metrics
Base Score:
7.8 High
Impact Score:
5.9
Exploitability Score:
1.8
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector (AV):
Local
Attack Complexity (AC):
Low
Privileges Required (PR):
Low
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High

General Information

Vendors

  • microsoft

Products

  • visual studio 2015,
  • visual studio 2017,
  • visual studio 2019,
  • visual studio 2022

Additional Info

Technical Analysis