{"uuid": "2d0b7125-9b55-4215-80c1-8a1040e93e27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-33675", "type": "seen", "source": "https://t.me/hacking_Attack/61245", "content": "Black Hat Ethical Hacking\nMicrosoft fixes dozens of Azure Site Recovery privilege escalation bugs\n\nMicrosoft fixes dozens of Azure Site Recovery privilege escalation bugsPost Views: 33 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 2 Minutes\nMicrosoft has fixed 32 vulnerabilities in the Azure Site Recovery suite that could have allowed attackers to gain elevated privileges or perform remote code execution.\n\nThe Azure Site Recovery service is a disaster recovery service that will automatically fail-over workloads to secondary locations when a problem is detected.\n\nAs part of the July 2022 Patch Tuesday, Microsoft fixed 84 flaws, with Azure Site Recovery vulnerability accounting for more than a third of the bugs fixed today.\n\nOf the thirty-two vulnerabilities fixed in Azure Site Recovery, two allow remote code execution, and a whopping thirty vulnerabilities allow for elevation of privileges.\n\nIn an advisory released today, Microsoft states that SQL injection vulnerabilities caused most of the privilege escalation bugs.\n\nHowever, Microsoft also highlighted a CVE-2022-33675 vulnerability caused by a DLL hijacking vulnerability discovered by Tenable.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course A DLL hijacking flawThe DLL hijacking flaw is tracked as CVE-2022-33675\u00a0and has a CVSS v3 severity rating of 7.8. It was discovered by researchers at Tenable, who disclosed it to Microsoft on April 8, 2022.\n\nDLL hijacking attacks exploit vulnerabilities caused by insecure permission on folders that a Windows OS searches and loads DLLs required when an application is launched.\n\nTo perform the attack, a threat actor can create a custom, malicious DLL using the same name as a regular DLL loaded by the Azure Site Recovery application. This malicious DLL is then stored in a folder that Windows searches, causing it to be loaded and executed when the application starts.\n\nAccording to Tenable, the \u201ccxprocessserver\u201d service of ASR runs with SYSTEM level privileges by default, and its executable lies in a directory that has been incorrectly set to allow \u2018write\u2019 permissions to any user.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/Security/wrong-permissions(1).png \nPotential implicationsBy acquiring admin-level privileges on a target system, an attacker would be free to change the OS security settings, make changes to user accounts, access all files on the system without restrictions, and install additional software.\n\nConsidering how widely\u00a0ASR is used in corporate environments that rely on uninterrupted cloud applications and services, it could serve as a crucial weak point [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:44.528370Z"}