Two major security flaws detected in Microsoft Azure Cloud, reveals report

mood · Jan 30, 2020

Two major security flaws detected in Microsoft Azure Cloud, reveals report
January 30, 2020
https://www.livemint.com/technology...zure-cloud-reveals-report-11580389929853.html

As Microsoft CEO Satya Nadella emphasized on keeping Azure Cloud secure with integrated end-to-end identity, security and compliance solutions, cybersecurity firm Check Point on Thursday revealed that it identified two major security flaws in Microsoft Azure last year which have now been fixed.

The researchers at Israel-based Check Point discovered that a user on the Azure network could have potentially taken control over the entire server, opening a path to business code theft and manipulation.
The first security flaw was found in Azure Stack and the second security flaw was found in Azure App Service.

The first security flaw was disclosed by Check Point on January 19 last year while the second security flaw was disclosed on June 27. Full patches for both security flaws in Azure were issued to the public by the end of 2019.
Click to expand...

Check Point Research:

Cloud security is like voodoo. Clients blindly trust the cloud providers and the security they provide. If we look at popular cloud vulnerabilities, we see that most of them focus on the security of the client’s applications (aka misconfigurations or vulnerable applications), and not the cloud provider infrastructure itself. We wanted to disprove the assumption that cloud infrastructures are secure.
Click to expand...

Remote Cloud Execution – Critical Vulnerabilities in Azure Cloud Infrastructure (Part I)
Remote Cloud Execution – Critical Vulnerabilities in Azure Cloud Infrastructure (Part II)

mood · Oct 9, 2020

Microsoft Azure Flaws Open Admin Servers to Takeover
October 8, 2020
https://threatpost.com/microsoft-azure-flaws-servers-takeover/159965/

Researchers have disclosed two flaws in Microsoft’s Azure web hosting application service, App Services, which if exploited could enable an attacker to take over administrative servers.

Azure App Services is an HTTP-based service for hosting web applications, and is available in both Microsoft Azure Cloud and on-premise installations. Researchers found two vulnerabilities in the cloud service that specifically affect Linux servers.

“The two vulnerabilities we found allow us to combine them and enable any attacker with the ability to forge post requests (SSRF) or [remote] code execution on an Azure App Service to take over the Azure App Service administration server,” said Paul Litvak, researcher with Intezer, in a Thursday post.
Click to expand...

KuduLite Bugs
The first flaw stems from an open-source project called KuduLite within Azure App Services.
After discovering that the KuduLite instance’s SSH service uses hardcoded credentials “root:Docker!” to access the application node, researchers were able to log in as root.

The second flaw exists in the KuduLite API. The issue here stems from the application node being able to send requests to the KuduLite API sans access validation – an error that is especially problematic when considering a web app with an SSRF vulnerability, researchers said.
Click to expand...

These two vulnerabilities can be chained together, since once an attacker achieves code execution with the second vulnerability, they can then exploit the first one.
Click to expand...

Intezer: Kud I Enter Your Server? New Vulnerabilities in Microsoft Azure

We discovered two vulnerabilities in Microsoft Azure. They existed in a popular cloud service called Azure App Services—specifically impacting Linux servers—and should be on the radar of enterprise organizations that use cloud resources.
Conclusion
The cloud enables developers to build and deploy their applications at great speed and flexibility, however, often the infrastructure is susceptible to vulnerabilities out of their control. In the case of App Services, applications are co-hosted with an additional administration container and as we’ve seen in this post, additional components can bring additional threats.

We reached out to Microsoft with our findings as part of the responsive disclosure process and the vulnerabilities were quickly acknowledged and fixed.
Click to expand...

mood · Dec 23, 2021

Microsoft Azure App Service flaw exposed customer source code
December 22, 2021

A security flaw found in Azure App Service, a Microsoft-managed platform for building and hosting web apps, led to the exposure of PHP, Node, Python, Ruby, or Java customer source code for at least four years, since 2017.

Only Azure App Service Linux customers were impacted by the issue discovered and reported by researchers at cloud security vendor Wiz.io, with IIS-based applications deployed by Azure App Service Windows customers not being affected.

"The vulnerability, which we dubbed as 'NotLegit,' has existed since September 2017 and has probably been exploited in the wild," Wiz.io added.
While this could point to attackers already knowing of the NotLegit flaw and specifically trying to find exposed Azure App Service apps' source code, these scans could also be explained as normal scans for exposed .git folders.
Click to expand...

Wiz.io: NotLegit: Azure App Service vulnerability exposed hundreds of source code repositories

The Wiz Research Team detected an insecure default behavior in the Azure App Service that exposed the source code of customer applications written in PHP, Python, Ruby, or Node, that were deployed using “Local Git”.

Wiz reported this security flaw to Microsoft on October 7th, 2021, and by now it has been mitigated. Small groups of customers are still potentially exposed and should take certain user actions to protect their applications, as detailed in several email alerts Microsoft issued between the 7th - 15th of December, 2021.
Click to expand...

Log in or Sign up

Two major security flaws detected in Microsoft Azure Cloud, reveals report

mood Updates Team

mood Updates Team

mood Updates Team