Microsoft Azure File Sync Improper Access Control Vulnerability Allowing Privilege Escalation

A vulnerability has been identified in Microsoft Azure File Sync that allows an authorized attacker to improperly elevate privileges locally. This issue arises from improper access control, enabling attackers to gain unauthorized permissions and perform file operations in restricted directories.

Impact

Exploitation of this vulnerability could lead to unauthorized access to directories in Azure File Sync servers, allowing attackers to perform file operations they would not normally be permitted to.

Remediation

The vulnerability has been addressed with a recent update to Azure File Sync's backend infrastructure. Customers do not need to upgrade to the latest version of the Azure File Sync agent. Those who need to inspect and correct their Access Control Lists have been notified through Azure Service Health Alerts.