Synopsis
Tenable Research has discovered a privilege escalation vulnerability that allows a user to escalate privileges to that of the root user within a Spark VM in the Synapse Analytics environment.
The flaws allowing this elevation of privilege exists in the "filesharemount.sh" script that users have access to in order to mount remote file shares in their Synapse environments. Users are able to replace the contents of this file with any arbitrary commands, which allow them to execute in the context of the root user for this environment.
For more details, please see our Tenable Techblog entry.
Solution
Microsoft began patching this issue as early as April 30, 2022. At the time of this writing, the issue is considered fully resolved. No action is required by end users.
Additional References
https://medium.com/tenable-techblog/microsoft-azure-synapse-pwnalytics-87c99c036291Disclosure Timeline
All information within TRA advisories is provided “as is”, without warranty of any kind, including the implied warranties of merchantability and fitness for a particular purpose, and with no guarantee of completeness, accuracy, or timeliness. Individuals and organizations are responsible for assessing the impact of any actual or potential security vulnerability.
Tenable takes product security very seriously. If you believe you have found a vulnerability in one of our products, we ask that you please work with us to quickly resolve it in order to protect customers. Tenable believes in responding quickly to such reports, maintaining communication with researchers, and providing a solution in short order.
For more details on submitting vulnerability information, please see our Vulnerability Reporting Guidelines page.
If you have questions or corrections about this advisory, please email [email protected]
Contact our sales team