Microsoft Defender for IoT Remote Code Execution Vulnerability

Vulnerability

The vulnerability is an SQL injection in the update-handshake endpoint of Microsoft Azure Defender for IoT [1]. The lack of proper validation of user-supplied strings before constructing SQL queries allows an attacker to inject malicious SQL commands. No authentication is required to reach this endpoint. The affected product is Microsoft Azure Defender for IoT; specific versions are not listed in the reference.

Exploitation

An unauthenticated remote attacker can send a crafted request to the update-handshake endpoint with a malicious SQL payload [1]. This allows the attacker to bypass authentication and then execute arbitrary code in the context of root.

Impact

Successful exploitation grants the attacker root-level access to the system, enabling full compromise of confidentiality, integrity, and availability [1]. The attacker can execute arbitrary code with highest privileges.

Mitigation

No specific mitigation details are provided in the available references [1]. Users should monitor Microsoft's security advisories for updates and apply patches when available.