High
CVE-2024-20656
CVE-2024-20656
Add Assessment
Technical Analysis
CVE-2024-20656 is an elevation of privilege vulnerability in Microsoft Visual Studio, specifically in the Diagnostics Hub Standard Collector. This vulnerability, if exploited, allows an attacker to gain SYSTEM privileges on affected systems. Vulnerabilities like these are often observed being used in ransomware attacks.
This vulnerability concerns an issue with the VSStandardCollectorService150 service, which is used for diagnostic purposes in Visual Studio and runs in the NT AUTHORITY\SYSTEM context. The flaw was discovered by security researcher Filip Dragović, who also released a proof-of-concept (PoC) exploit code.
The exploit starts with the creation of a dummy directory where the VSStandardCollectorService150 writes files. The attacker then uses a series of manipulations involving junction directories and symbolic links, culminating in replacing a critical binary with a commandeered version to gain a SYSTEM shell.
To mitigate this issue, Microsoft released a patch as part of their Patch Tuesday updates. Users of Visual Studio are advised to apply the security update to prevent exploitation of this vulnerability. The update applies to all Visual Studio 2015 Update 3 editions except Build Tools.
CVSS V3 Severity and Metrics
General Information
Vendors
- microsoft
Products
- visual studio 2015,
- visual studio 2017,
- visual studio 2019,
- visual studio 2022
References
Exploit
Additional sources will be added here as they become relevant.
Notes: We will only add the top 3 POCs for a given CVE. POCs added here must have at least 2 GitHub stars.
