Technology NewsMicrosoft Azure Services Flaws Could've Exposed Cloud Resources to...

Microsoft Azure Services Flaws Could’ve Exposed Cloud Resources to Unauthorized Access

-


Jan 17, 2023Ravie LakshmananCloud Security / Bug Report

Microsoft Azure Services Flaws Could’ve Exposed Cloud Resources to Unauthorized Access

Four different Microsoft Azure services have been found vulnerable to server-side request forgery (SSRF) attacks that could be exploited to gain unauthorized access to cloud resources.

The security issues, which were discovered by Orca between October 8, 2022 and December 2, 2022 in Azure API Management, Azure Functions, Azure Machine Learning, and Azure Digital Twins, have since been addressed by Microsoft.

“The discovered Azure SSRF vulnerabilities allowed an attacker to scan local ports, find new services, endpoints, and sensitive files – providing valuable information on possibly vulnerable servers and services to exploit for initial entry and the location of sensitive information to target,” Orca researcher By Lidor Ben Shitrit said in a report shared with The Hacker News.

Two of the vulnerabilities affecting Azure Functions and Azure Digital Twins could be abused without requiring any authentication, enabling a threat actor to seize control of a server without even having an Azure account in the first place.

SSRF attacks could have serious consequences as they enable a malicious interloper to read or update internal resources, and worse, pivot to other parts of the network, breach otherwise unreachable systems to extract valuable data.

Three of the flaws are rated Important in severity, while the SSRF flaw impacting Azure Machine Learning is rated Low in severity. All the weaknesses can be leveraged to manipulate a server to mount further attacks against a susceptible target.

A brief summary of the four vulnerabilities is as follow –

  • Unauthenticated SSRF on Azure Digital Twins Explorer via a flaw in the /proxy/blob endpoint that could be exploited to get a response from any service that’s suffixed with “blob.core.windows[.]net”
  • Unauthenticated SSRF on Azure Functions that could be exploited to enumerate local ports and access internal endpoints
  • Authenticated SSRF on Azure API Management service that could be exploited to list internal ports, including one associated with a source code management service that could then be used to access sensitive files
  • Authenticated SSRF on Azure Machine Learning service via the /datacall/streamcontent endpoint that could be exploited to fetch content from arbitrary endpoints

To mitigate such threats, organizations are recommended to validate all input, ensure that servers are configured to only allow necessary inbound and outbound traffic, avoid misconfigurations, and adhere to the principle of least privilege (PoLP).

“The most notable aspect of these discoveries is arguably the number of SSRF vulnerabilities we were able to find with only minimal effort, indicating just how prevalent they are and the risk they pose in cloud environments,” Ben Shitrit said.

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.



LEAVE A REPLY

Please enter your comment!
Please enter your name here

Latest news

How to know that you have to buy a new mobile phone

Despite the fact that smartphones can perfectly last several years being functional today, there are a series of...

எந்த வயதில் மக்கள் குறைவாக தூங்குகிறார்கள்?

ஆய்வில் பங்கேற்றவர்களில் இளையவர் (வயது 19) அதிகம் தூங்குவதாகவும் ஆய்வில் கண்டறியப்பட்டுள்ளது.இருந்து ஆராய்ச்சியாளர்கள் நடத்திய புதிய ஆய்வு லண்டன் பல்கலைக்கழக கல்லூரிதி கிழக்கு ஆங்கிலியா...

MSI laptops with NVIDIA GeForce RTX 4000 graphics – report from the premiere event in Warsaw

At this year's CES in Las Vegas, NVIDIA presented the new generation of GeForce RTX 4000 mobile graphics...

New Wave of Ransomware Attacks Exploiting VMware Bug to Target ESXi Servers

Feb 04, 2023Ravie LakshmananEnterprise Security / Ransomware VMware ESXi hypervisors are the target of a new wave of attacks...

MSI laptops with NVIDIA GeForce RTX 4000 graphics – report from the premiere event in Warsaw

At this year's CES in Las Vegas, NVIDIA presented the new generation of GeForce RTX 4000 mobile graphics...

New Wave of Ransomware Attacks Exploiting VMware Bug to Target ESXi Servers

Feb 04, 2023Ravie LakshmananEnterprise Security / Ransomware VMware ESXi hypervisors are the target of a new wave of attacks...

Must read

Bermuda hit by widespread internet outage amid power cut

Bermuda experienced a widespread power outage since Friday evening...