Two major security flaws detected in Microsoft Azure Cloud, reveals report

mood · Jan 30, 2020

Two major security flaws detected in Microsoft Azure Cloud, reveals report
January 30, 2020
https://www.livemint.com/technology...zure-cloud-reveals-report-11580389929853.html

As Microsoft CEO Satya Nadella emphasized on keeping Azure Cloud secure with integrated end-to-end identity, security and compliance solutions, cybersecurity firm Check Point on Thursday revealed that it identified two major security flaws in Microsoft Azure last year which have now been fixed.

The researchers at Israel-based Check Point discovered that a user on the Azure network could have potentially taken control over the entire server, opening a path to business code theft and manipulation.
The first security flaw was found in Azure Stack and the second security flaw was found in Azure App Service.

The first security flaw was disclosed by Check Point on January 19 last year while the second security flaw was disclosed on June 27. Full patches for both security flaws in Azure were issued to the public by the end of 2019.
Click to expand...

Check Point Research:

Cloud security is like voodoo. Clients blindly trust the cloud providers and the security they provide. If we look at popular cloud vulnerabilities, we see that most of them focus on the security of the client’s applications (aka misconfigurations or vulnerable applications), and not the cloud provider infrastructure itself. We wanted to disprove the assumption that cloud infrastructures are secure.
Click to expand...

Remote Cloud Execution – Critical Vulnerabilities in Azure Cloud Infrastructure (Part I)
Remote Cloud Execution – Critical Vulnerabilities in Azure Cloud Infrastructure (Part II)

mood · Oct 9, 2020

Microsoft Azure Flaws Open Admin Servers to Takeover
October 8, 2020
https://threatpost.com/microsoft-azure-flaws-servers-takeover/159965/

Researchers have disclosed two flaws in Microsoft’s Azure web hosting application service, App Services, which if exploited could enable an attacker to take over administrative servers.

Azure App Services is an HTTP-based service for hosting web applications, and is available in both Microsoft Azure Cloud and on-premise installations. Researchers found two vulnerabilities in the cloud service that specifically affect Linux servers.

“The two vulnerabilities we found allow us to combine them and enable any attacker with the ability to forge post requests (SSRF) or [remote] code execution on an Azure App Service to take over the Azure App Service administration server,” said Paul Litvak, researcher with Intezer, in a Thursday post.
Click to expand...

KuduLite Bugs
The first flaw stems from an open-source project called KuduLite within Azure App Services.
After discovering that the KuduLite instance’s SSH service uses hardcoded credentials “root:Docker!” to access the application node, researchers were able to log in as root.

The second flaw exists in the KuduLite API. The issue here stems from the application node being able to send requests to the KuduLite API sans access validation – an error that is especially problematic when considering a web app with an SSRF vulnerability, researchers said.
Click to expand...

These two vulnerabilities can be chained together, since once an attacker achieves code execution with the second vulnerability, they can then exploit the first one.
Click to expand...

Intezer: Kud I Enter Your Server? New Vulnerabilities in Microsoft Azure

We discovered two vulnerabilities in Microsoft Azure. They existed in a popular cloud service called Azure App Services—specifically impacting Linux servers—and should be on the radar of enterprise organizations that use cloud resources.
Conclusion
The cloud enables developers to build and deploy their applications at great speed and flexibility, however, often the infrastructure is susceptible to vulnerabilities out of their control. In the case of App Services, applications are co-hosted with an additional administration container and as we’ve seen in this post, additional components can bring additional threats.

We reached out to Microsoft with our findings as part of the responsive disclosure process and the vulnerabilities were quickly acknowledged and fixed.
Click to expand...

Log in or Sign up

Two major security flaws detected in Microsoft Azure Cloud, reveals report

mood Updates Team

mood Updates Team

Log in or Sign up

Two major security flaws detected in Microsoft Azure Cloud, reveals report

mood Updates Team

mood Updates Team

Useful Searches