SecBoard
Zurück zur CVE-Übersicht

CVE-2026-96204

MEDIUM(6.5)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Risk Signal Score16/100 — NIEDRIG
  • CVSS 6.5 — Mittel

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.8%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

6.5

Technische Schwere

Beschreibung

Server-side request forgery (ssrf) in Azure Arc allows an authorized attacker to elevate privileges over a network.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • Arc Enabled Servers - Azure Connected Machine Agent versions antérieures à 1.68

Threat-Hunting-Queries

Detect attempts to perform Server-Side Request Forgery (SSRF) in Azure Arc environments. This typically involves monitoring network requests originating from the Azure Connected Machine Agent that target internal or unexpected external resources.

Sentinel/Defender KQL

AzureActivity
| where OperationName == "Microsoft.HybridCompute/machines/write" or OperationName == "Microsoft.HybridCompute/machines/extensions/write"
| where Properties contains "ssrf" or Properties contains "server-side request forgery" // Placeholder for actual SSRF indicators in logs
| project TimeGenerated, ResourceId, OperationName, Caller, Properties

Splunk SPL

index=azure (sourcetype="azure:activitylog" OR sourcetype="azure:monitor") (OperationName="Microsoft.HybridCompute/machines/write" OR OperationName="Microsoft.HybridCompute/machines/extensions/write") (ssrf OR "server-side request forgery")
| table _time, ResourceId, OperationName, Caller, Properties

Sigma

title: Azure Arc SSRF Attempt
status: experimental
description: Detects potential Server-Side Request Forgery (SSRF) attempts in Azure Arc environments.
logsource:
  product: azure
  service: activitylog
detection:
  selection:
    OperationName:
      - 'Microsoft.HybridCompute/machines/write'
      - 'Microsoft.HybridCompute/machines/extensions/write'
    Properties|contains:
      - 'ssrf'
      - 'server-side request forgery'
  condition: selection
level: medium

Elastic ES|QL

FROM azure_activity_logs
| WHERE operation_name IN ('Microsoft.HybridCompute/machines/write', 'Microsoft.HybridCompute/machines/extensions/write')
| WHERE properties ILIKE '%ssrf%' OR properties ILIKE '%server-side request forgery%'
| SELECT @timestamp, resource_id, operation_name, caller, properties

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen