Conversation

Notices

1. Embed this notice
   Kevin Beaumont (gossithedog@cyberplace.social)'s status on Wednesday, 05-Mar-2025 00:32:29 JST Kevin Beaumont

   Not sure if anybody else caught this, but CISA added CVE-2024-49035 to KEV a week ago - that vuln is about partner.microsoft.com being owned.

   Partner.microsoft.com is a portal which allows orgs to grant access to Microsoft 365 tenants, ie read data of downstream customers. #threatintel

   • Embed this notice
     System Adminihater (systemadminihater@cyberplace.social)'s status on Wednesday, 05-Mar-2025 00:39:39 JST System Adminihater

     in reply to

     @GossiTheDog The partner site getting owned makes a lot of sense given that they never update anything in it.

   • Embed this notice
     chapulin (chapulin@cyberplace.social)'s status on Wednesday, 05-Mar-2025 00:42:17 JST chapulin

     in reply to

     @GossiTheDog I wonder if threat actors could gain access to the tenants 🤢

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Wednesday, 05-Mar-2025 00:51:01 JST Kevin Beaumont

     in reply to

     This is the partner.microsoft.com portal, it allows CSPs - Cloud Solution Providers - to gain access to their customer's environments.

     CVE-2024-49035 was around improper privilege management, i.e. being able to access things you shouldn't.

     It being in CISA KEV says it was being exploited in the wild.

     That portal allows a huge footprint of access by design.

     GreenSkyOverMe (Monika) repeated this.
   • Embed this notice
     cR0w :cascadia: (cr0w@infosec.exchange)'s status on Wednesday, 05-Mar-2025 00:55:08 JST cR0w :cascadia:

     in reply to

     @GossiTheDog I thought this one was discussed when it came out because MSRC changed it from exploited:no to exploited:yes the day after it was originally published. I think it was in a screaminggoat thread though so I can't search for it anymore.

   • Embed this notice
     Dr. Christopher Kunz (christopherkunz@chaos.social)'s status on Wednesday, 05-Mar-2025 01:44:13 JST Dr. Christopher Kunz

     in reply to

     @GossiTheDog This is a screenshot of the first snapshot for the CVE-2024-49035 advisory on MSRC. MS knew about exploitation from the get-go. Not sure why CISA is picking this up only now, being long patched and whatnot.

   • Embed this notice
     Dr. Christopher Kunz (christopherkunz@chaos.social)'s status on Wednesday, 05-Mar-2025 02:14:21 JST Dr. Christopher Kunz

     @GossiTheDog A couple of hours or day after publication maybe, my screenshot is from november 27.

   • Embed this notice
     V4N4D1S (v4n4d1s@mastodon.social)'s status on Wednesday, 05-Mar-2025 02:36:48 JST V4N4D1S

     in reply to

     @GossiTheDog One of our security providers told us to patch it immediately, because it was added to CISA KEV.

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Saturday, 08-Mar-2025 01:11:56 JST Kevin Beaumont

     in reply to

     :blobcatcomfypeek: https://mastodon.social/@expertenkommision_cyberunfall/114121947666456740