Document Intelligence Studio On-Prem Elevation of Privilege Vulnerability

The path traversal vulnerability in Azure AI Document Intelligence Studio allows an attacker to read or write files outside of the intended directory. This could lead to unauthorized access to sensitive data, including configuration files, credentials, or even system files. Successful exploitation could enable an attacker to gain control over the affected system and potentially move laterally within the network. The CRITICAL CVSS score reflects the high potential for severe impact and ease of exploitation.

Organizations heavily reliant on Azure AI Document Intelligence Studio for document processing and those with complex network configurations are particularly at risk. Environments with weak access controls or legacy configurations are also more vulnerable.

• windows / dotnet: Use PowerShell to check for unusual file access patterns.

Get-WinEvent -LogName Security -Filter "EventID=4663 and SubjectUserName!=''" | Where-Object {$_.Properties[0].Value -like 'C:\*\*\*'} | Format-Table -Property TimeCreated, SubjectUserName, ProcessName, Path

• linux / server: Monitor system logs (journalctl) for suspicious file access attempts.

journalctl | grep -i "path traversal" | grep -i "error"

• generic web: Monitor access logs for requests containing unusual path characters (../, \..). Check response headers for unexpected file disclosures.

1. 2025-05-13Disclosure

   disclosure

1. Gereserveerd2025-03-21
2. Gepubliceerd2025-05-13
3. Gewijzigd2026-02-13
4. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2025-30387 is to immediately upgrade Azure AI Document Intelligence Studio to version 1.0.03019.1-official-7241c17a or later. If upgrading is not immediately feasible, consider implementing strict input validation and sanitization on all file paths used within the application to prevent malicious path manipulation. Review and restrict file system permissions to minimize the potential impact of a successful attack. After upgrade, confirm the fix by attempting to access files outside the intended directory and verifying access is denied.