A critical security vulnerability in Microsoft Update Health Tools (KB4023057) has been discovered that could allow attackers to execute arbitrary code remotely on Windows devices by exploiting abandoned Azure Blob Storage accounts.
The flaw affects environments using the Update Health Service (uhssvc.exe), a Microsoft-signed component designed to help enterprises deploy security updates faster via Intune.
How the Attack Works
The Update Health Service, located at C:\Program Files\Microsoft Update Health Tools\uhssvc.exe, periodically connects to Azure Blob Storage to retrieve JSON configuration files that control update behavior.
In version 1.0 of Update Health Tools, the client contacted storage accounts named payloadprod0.blob.core.windows.net through payloadprod15.blob.core.windows.net.
Security researchers at Eye Security discovered that several of these storage accounts were no longer under Microsoft’s control.
When researchers registered the abandoned payloadprod0 account, they immediately observed hundreds of HTTP GET requests from Windows devices worldwide, all using the user agent UHSMAILBOX.
The requests targeted structured paths, including enrollment status, device configurations, and policy files.
Because the tool fully trusted the contents of these JSON files, attackers could control the storage accounts, influencing the actions performed by enterprise devices.
The policy JSON files include an EnterpriseActionType field that specifies what Update Health Tools should execute. One supported action is “ExecuteTool,” which instructs the client to run a specific executable with given parameters.
While a safeguard exists that only permits Microsoft-signed binaries with embedded signatures, Windows ships with such binaries by default, including explorer.exe.
Attackers could craft a malicious JSON payload instructing the client to execute a trusted Microsoft binary in a way that would launch arbitrary programs, thereby achieving remote code execution on affected endpoints.
During a seven-day collection window across ten reclaimed storage accounts, researchers observed 544,386 HTTP requests from Update Health Tools, traffic from 9,976 unique Azure tenants, 8,536 tenants checking enrollment status, and 3,491 tenants with 40,973 unique devices retrieving policy data.
Microsoft no longer distributes version 1.0 of Update Health Tools and offers version 1.1, released in December 2022, which introduces proper web service endpoints at devicelistenerprod.microsoft.com that cannot be hijacked.
EU customers received additional protection through dedicated endpoints such as devicelistenerprod.eudb.microsoft.com.
However, the blob-based communication path remained backward-compatible and could be re-enabled via registry configuration, leaving some devices at risk.
Find this Story Interesting! Follow us on Google News, LinkedIn and X to Get More Instant Updates
%20(1).webp?fit=1600,900&ssl=1&description=The flaw affects environments using the Update Health Service (uhssvc.exe), a Microsoft-signed component designed to help enterprises deploy security updates faster via Intune.){kind=link}