Microsoft Dynamics 365 (On-Premises) Privilege Escalation Vulnerability

A vulnerability in Microsoft Dynamics 365 (on-premises) has been identified, allowing an authorized attacker to elevate privileges over a network. This issue arises from improper handling of permissions, enabling attackers to assign themselves the System Administrator role and gain full administrative control.

Impact

Exploitation of this vulnerability could lead to unauthorized administrative privileges, allowing attackers to gain full control over the affected Dynamics 365 organization.

Reproduction

To reproduce this vulnerability, an authorized user must send a specially crafted request to the scenario-switching page, which fails to properly validate permissions. This request can be used to incorrectly assign the System Administrator role to the user, thereby granting full administrative rights.

Remediation

Users can download the security update for Microsoft Dynamics 365 (on-premises) version 9.1 through the Microsoft Dynamics 365 Railyard Release Management platform.