XSS Vulnerabilities in Azure: Examining Unauthorized User Session Access

XSS Vulnerabilities in Azure Led to Unauthorized Access to User Sessions

Overview

Cloud security firm Orca has identified two cross-site scripting (XSS) vulnerabilities in Azure Bastion and Azure Container Registry (ACR) that could have resulted in unauthorized access to user sessions, data tampering, and service disruptions. These vulnerabilities were resolved by Microsoft in April and May 2023. The vulnerabilities occurred due to a weakness in the postMessage iframe, which allowed attackers to embed endpoints within remote servers using the iframe tag and execute malicious JavaScript code.

Azure Bastion Vulnerability

Azure Bastion serves as a hardened gateway to provide access to virtual machines by creating a private remote desktop protocol (RDP) or secure shell (SSH) session between the local machine and Azure VMs. The vulnerability in Azure Bastion was found in the Azure Network Watcher connection troubleshooter. In this case, the weakness was due to incorrectly implemented validation checks, which allowed an attacker to craft an HTML page that, once rendered in the victim’s browser, would lead to code execution. Orca found multiple security weaknesses that contributed to the vulnerability, enabling an attacker to automate the execution of a malicious SVG payload on behalf of the victim.

Azure Container Registry Vulnerability

The vulnerability in Azure Container Registry was found in an HTML code snippet in an unused web page within ACR’s Azure Portal extension. Orca discovered an HTML file that allowed for code injection. Azure Container Registry is a managed cloud service that allows users to deploy, manage, and store container images from a centralized location. In this case, the vulnerability occurred due to a missing origin check in the communication between iframes and postMessages. Orca reported this XSS vulnerability to Microsoft, who subsequently resolved the issue by removing the vulnerable file.

Microsoft’s Response

Microsoft was notified of the XSS vulnerabilities in Azure Bastion and Azure Container Registry by Orca in April and May, respectively. After reproducing the issues, Microsoft took appropriate action to address the vulnerabilities. For Azure Bastion, the vulnerable line of code in the Azure Network Watcher file was removed. In the case of Azure Container Registry, the ACR engineering team removed the vulnerable file, as it was determined to be legacy code and not used in the current Azure Portal experience.

No Evidence of Exploitation

Microsoft has stated that it has no evidence of any of these vulnerabilities being exploited in attacks, beyond the proof-of-concept code provided by Orca to demonstrate the vulnerabilities. This suggests that the vulnerabilities were not actively exploited before they were resolved.

Internet Security and the Threat Landscape

This incident highlights the ongoing challenge of ensuring internet security in an increasingly interconnected world. XSS vulnerabilities, like the ones found in Azure Bastion and Azure Container Registry, are just one example of the many potential entry points for attackers seeking unauthorized access to user sessions and sensitive data.

Addressing Vulnerabilities

It is crucial for cloud service providers and organizations to have robust security measures in place to prevent such vulnerabilities and mitigate potential risks. This includes regularly conducting security audits and testing, promptly addressing identified vulnerabilities, and ensuring that software and systems are kept up to date with the latest security patches.

The Role of Responsible Disclosure

In this case, the security vulnerabilities were discovered by Orca and responsibly disclosed to Microsoft. Responsible disclosure is a critical aspect of maintaining internet security. By reporting vulnerabilities to the appropriate organizations, security researchers can contribute to the ongoing improvement of the security landscape, enabling organizations to address and resolve vulnerabilities before they can be exploited by malicious actors.

Editorial: Strengthening Cloud Security

The Importance of Robust Security Frameworks

The discovery of XSS vulnerabilities in Azure Bastion and Azure Container Registry serves as a reminder of the need for robust security frameworks and practices in cloud computing environments. Cloud service providers like Microsoft must prioritize security by implementing stringent security measures at every level of their infrastructure.

Collaboration and Information Sharing

This incident also underscores the importance of collaboration and information sharing between cloud service providers, security researchers, and organizations that rely on cloud services. By fostering open communication and sharing best practices, the industry can collectively work towards establishing higher standards for cloud security.

Education and Awareness

Additionally, emphasis should be placed on educating users about best practices for internet security. Users must be aware of the potential risks and vulnerabilities present in cloud computing environments, and understand how to protect their data and sessions from unauthorized access. Cloud service providers should make efforts to provide clear and accessible guidance on security measures and encourage users to implement them.

Advice for Cloud Users

Regularly Update and Patch Systems

Users of cloud services, such as Azure, should ensure that they regularly update and patch their systems and applications. This includes promptly installing security updates and patches provided by cloud service providers. By keeping systems up to date, users can minimize their exposure to known vulnerabilities and reduce the risk of unauthorized access.

Implement Robust Access Controls

It is essential to implement robust access controls to prevent unauthorized access to cloud resources and sensitive data. This includes enforcing strong and unique passwords, implementing multi-factor authentication, and regularly reviewing and updating access policies.

Monitor for Anomalies

Proactively monitoring cloud environments for unusual activity and anomalies is essential. This can help identify potential security breaches or unauthorized access attempts. Implementing intrusion detection and prevention systems, as well as security information and event management (SIEM) tools, can aid in monitoring and alerting users to suspicious activities.

Stay Informed and Educated

Users should stay informed about the latest security threats and vulnerabilities affecting cloud services. This can be done by following reputable security news sources, participating in security forums and communities, and engaging with cloud service providers’ security documentation and updates. Staying educated about current security practices can help users make informed decisions about their cloud security.

Conclusion

The XSS vulnerabilities in Azure Bastion and Azure Container Registry serve as a reminder of the need for ongoing vigilance and proactive measures to ensure the security of cloud environments. By addressing vulnerabilities promptly and collaboratively, cloud service providers and users can work together to strengthen cloud security and protect against unauthorized access and data breaches.