The security flaw involves a classic privilege escalation method using a Set User ID (SUID) binary that is part of the AZNFS-mount utility installation, Varonis said in a report shared with Cyber Security News. This utility is designed to mount Azure Storage Account NFS endpoints, enabling users to reliably access Azure Blob storage via NFS when endpoint IP addresses change. A critical security vulnerability in AZNFS-mount, an Azure utility that allows attackers to escalate privileges from an unprivileged user to root on Linux machines. The vulnerability lies in the mount.aznfs binary, which is installed with SUID permissions and uses an insecure C function that can be exploited to execute arbitrary commands with root privileges. “When users execute ‘mount -t aznfs’, this runs the vulnerable binary ‘mount.aznfs’, which calls a script to create the mount point,” explained Varonis researchers in their disclosure published earlier this week. This allows attackers to execute arbitrary commands as root, potentially enabling them to mount additional storage containers, install malware, or move laterally through networks and cloud environments. Organizations using Azure storage should review their security configurations regularly and maintain updated utilities to prevent potential exploitation of vulnerabilities like this one. AZNFS Mount is installed using an installation script (aznfs_install.sh) that runs as the root account, creating binaries that operate with superuser privileges to establish mount points and modify DNAT rules. Azure Blob Storage, one of Microsoft’s most popular cloud storage solutions, supports various access methods, including REST API, SFTP, and NFS protocol. Azure customers using Azure HPC images or utilizing NFS for Azure Storage should immediately enable the utility’s auto-update feature or manually update to the latest version. It’s important to note that access via NFS doesn’t interoperate with other Azure Storage permission models, such as role-based and attribute access controls. The vulnerability centers around the mount.aznfs binary, which is packaged with the 4755 file mode-meaning the SUID bit is activated and anyone can execute it. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 09 May 2025 03:05:00 +0000