Summary
Microsoft warns of Azure Service Tag exploit by malicious actors to bypass firewall rules and gain unauthorized access to cloud resources, highlighting the inherent risk of relying solely on service tags for network security.
Technical Details
Azure Service Tags simplify network isolation within Azure by grouping specific Azure services IP ranges. These tags can be used to define network security rules and apply these rules consistently across multiple Azure resources. Essentially, Azure Service Tags provide a convenient way to manage access controls, such as firewall rules or network security group (NSG) configurations.
Microsoft issued a warning about the potential misuse of Azure Service Tags, which could allow attackers to forge requests from a trusted service and bypass firewall rules. This issue, highlighted by Tenable, reveals that Azure customers who depend on service tags for firewall rules could be vulnerable. At least 10 Azure services are affected: Azure Application Insights, Azure DevOps, Azure Machine Learning, Azure Logic Apps, Azure Container Registry, Azure Load Testing, Azure API Management, Azure Data Factory, Azure Action Group, Azure AI Video Indexer, and Azure Chaos Studio.
The core problem arises when an attacker in one tenant can send crafted web requests to access resources in another tenant if the latter has allowed traffic from the service tag without additional authentication. This vulnerability allows the attacker to manipulate server-side requests and impersonate legitimate Azure services. Consequently, the attacker can circumvent network controls that rely on Service Tags, which are typically used to block public access to Azure customers’ internal assets, data, and services.
Recommendations
References
Companies continue to get breached every single day, even though they spend hundreds of thousands of dollars each year on cyber security. The combination of unknown exposed assets and inadequate testing, with the reality of siloed security programs, creates the perfect storm that Gartner suggests organizations address as part of an External Exposure Management program. Join this session to learn more about the state of exposure management, its key challenges, and effective solutions.
REGISTER NOW: https://www.eventbrite.com/e/lunch-and-learn-maggianos-june-20-2024-registration-918497058427?aff=oddtdtcreator
OVERVIEW
A vulnerability in SolarWinds Serv-U could allow for path transversal, leading to disclosure of sensitive information. SolarWinds Serv-U is a managed file transfer solution, hosted on Windows and Linux-based servers, used to store and share files across an enterprise network. Exploitation of this vulnerability could allow for the disclosure of files and directories on the host. Depending on the permissions associated with the files, an attacker could view content within them. Files with stricter access controls and file permissions could be less impacted.
THREAT INTELLIGENCE
There are currently no reports of this vulnerability being exploited in the wild.
SYSTEMS AFFECTED
RECOMMENDATIONS
We recommend the following actions be taken:
REFERENCES