New Microsoft Azure Vulnerability Uncovered — Experts Warn of RCE Attacks

Jan 19, 2023Ravie LakshmananCloud Security / Data Security

A new critical remote code execution (RCE) flaw discovered
impacting multiple services related to Microsoft Azure could be
exploited by a malicious actor to completely take control of a
targeted application.

“The vulnerability is achieved through CSRF^[1]
(cross-site request forgery) on the ubiquitous SCM service Kudu,”
Ermetic researcher Liv Matan said^[2]
in a report shared with The Hacker News. “By abusing the
vulnerability, attackers can deploy malicious ZIP files containing
a payload to the victim’s Azure application.”

The Israeli cloud infrastructure security firm, which dubbed the
shortcoming EmojiDeploy, said it could further
enable the theft of sensitive data and lateral movement to other
Azure services.

Microsoft has since fixed the vulnerability as of December 6,
2022, following responsible disclosure on October 26, 2022, in
addition to awarding a bug bounty of $30,000.

The Windows maker describes^[3]
Kudu as the “engine behind a number of features in Azure App
Service related to source control based deployment, and other
deployment methods like Dropbox and OneDrive sync.”

In a hypothetical attack chain devised by Ermetic, an adversary
could exploit the CSRF vulnerability in the Kudu SCM panel to
defeat safeguards put in place to thwart cross-origin attacks^[4]
by issuing a specially crafted request to the “/api/zipdeploy”
endpoint to deliver a malicious archive (e.g., web shell) and gain
remote access.

Cross-site request forgery, also known as sea surf or session
riding, is an attack vector whereby a threat actor tricks an
authenticated user of a web application into executing unauthorized
commands on their behalf.

The ZIP file, for its part, is encoded in the body of the HTTP
request, prompting the victim application to navigate to an
actor-control domain hosting the malware via the server’s same-origin policy^[5]
bypass.

“The impact of the vulnerability on the organization as a whole
depends on the permissions of the applications managed identity,”
the company said. “Effectively applying the principle of least
privilege can significantly limit the blast radius.”

The findings come days after Orca Security revealed^[6]
four instances of server-side request forgery (SSRF) attacks
impacting Azure API Management, Azure Functions, Azure Machine
Learning, and Azure Digital Twins.