Project Overview
This project documents the end-to-end vulnerability management lifecycle for a cloud-hosted Windows Server 2025 instance (CyberVM). The lab demonstrates a proactive approach to identifying, analyzing, and neutralizing high-severity security risks using both direct software patching and architectural compensating controls.
1. Identification & Baseline Assessment
An initial credentialed scan was performed using Nessus Essentials to establish a security baseline. The scan revealed 66 total vulnerabilities, including two high-priority targets.
| Severity | ID | Description | CVSS v3.0 |
|---|
| High | KB5075899 | Missing Windows Server 2026 Cumulative Update | 7.0 |
| High | CVE-2025-14847 | Uninitialized Heap Memory Leak in MongoDB (Splunk) | 7.5 |
Figure 1: Initial baseline scan identifying critical exposure points.
2. Technical Risk Analysis
- KB5075899: Missing patches for multiple CVEs that could lead to Remote Code Execution (RCE) or local privilege escalation.
- CVE-2025-14847: A protocol header length mismatch in the bundled MongoDB instance (v4.2.24) used by Splunk. This vulnerability allows unauthenticated clients to read uninitialized heap memory.
Task A: OS Patching (KB5075899)
- Challenge: Automated Windows Updates failed to progress.
- Solution: Manually intervened by downloading the standalone
.msu installer from the Microsoft Update Catalog and deploying it with administrative privileges.
- Result: Successfully updated system binaries and performed a mandatory reboot to finalize hardening.
Task B: Network Isolation (CVE-2025-14847)
- The Dilemma: Upgrading the bundled MongoDB was not feasible due to Splunk dependency constraints (Availability risk).
- The Pivot: While I initially designed an Azure Firewall Policy, I successfully pivoted to a Network Security Group (NSG) Inbound Rule due to subscription-level resource constraints. This demonstrates the ability to implement effective security controls within infrastructure limitations.
- Control Implemented:
- Rule:
Deny_MongoDB_8191
- Priority: 105
- Action: Deny
- Description: Preventive compensating control for CVE-2025-14847. Blocks exploit path for bundled MongoDB heap leak on CyberVM.
Figure 2: Implementation of host-level isolation via Azure NSG.
4. Verification & Validation
Following remediation, a final validation scan was executed to confirm the reduction of the attack surface.
- Status: REMEDIATED
- Technical Result: Both the OS-level RCE risk and the network-level memory leak path were successfully closed.
Figure 3: Final Nessus scan confirming successful risk mitigation.
Technical Skills Demonstrated
- Vulnerability Management: End-to-end lifecycle from discovery to verification.
- Cloud Infrastructure: Configuring Azure NSGs and designing Enterprise Firewall Policies.
- Threat Hunting (KQL): Developed Kusto queries to monitor for unauthorized access attempts on denied ports.
- Critical Thinking: Navigating infrastructure constraints to deliver effective security outcomes.
dawnsmithcyber/azure-vulnerability-remediation-project
