Friday, March 29, 2024

Critical Vulnerability in Microsoft Azure Let Hackers Take Over the Complete Control of the Azure Accounts

Researchers discovered a critical vulnerability in Microsoft Azure named “BlackDirect” that allows attackers to take over the Azure user’s accounts and create the Token with the victim’s permission.

The vulnerability specifically affected Microsoft’s OAuth 2.0 applications that allow a malicious attacker to access and control a victim’s account

“OAuth is a protocol for authorization that is commonly used as a way for end-users to grant websites or applications access to their information from other websites without giving the website or app secrets or passwords.”

In the next generation, OAuth2 allows third-party applications to grant limited access to an HTTP service, and accessing clients might be a website or mobile application.

OAuth applications trust domains and sub-domains are not registered on behalf of Microsoft, and they can be registered by anyone.

By default, OAuth approved the application’s request and is allowed to ask for “access_token.”.

Researchers found that the combination of these two factors makes it possible to produce action with the user’s permissions – including gaining access to Azure resources, AD resources, and more.

“This vulnerability’s attack surface is very wide and its impact can be very powerful. By doing nothing more than clicking or visiting a website, the victim can experience the theft of sensitive data, compromised production servers, lost data, manipulation of data, encryption of all the organization’s data with ransomware, and more.”

Exploiting the BlackDirect Vulnerability

To exploit the vulnerability, researchers initially listed all the service principals in their account using the “Get-AzureADServicePrincipal” command.

Later they found the URL that was allowed by the Microsoft application, in which some of the URLs end with “.cloudapp.net”, “.azurewebsites.net” and .{vm_region}.cloudapp.azure.com,” These are all the URLs registered via the Microsoft Azure portal.

Omer Tsarfati from cyberark said, “To make sure no real attackers could exploit this vulnerability, I registered every sub-domain that wasn’t already registered – 54 of them  That being said, there may be more sub-domains that aren’t listed.”

There are 3 following apps that are vulnerable for this account to take the attack.

  • Portfolios
  • O365 Secure Score
  • Microsoft Service Trust

“This vulnerability makes it much easier to compromise privileged users – whether through simple social engineering techniques or by infecting a website that the privileged users occasionally access.”

As a result, the attacker will compromise the entire domain and the organization’s Azure environment.

Proof of Concept Video:

You can read the complete technical analysis here.

Mitigation Steps

  1. Make sure that all the trusted redirect URIs configured in the application are under your ownership.
  2. Remove unnecessary redirect URIs.
  3. Make sure the permissions that the OAuth application asks for are the least privileged ones it needs.
  4. Disable non-used applications.

Also Read:

StrandHogg – Hackers Aggressively Exploiting New Unpatched Android OS Vulnerability in Wide Using Malware

Most Critical Docker Vulnerability Let Hackers Take Complete Control Over the Host & All Containers Within It

Website

Latest articles

Beware Of Weaponized Air Force invitation PDF Targeting Indian Defense And Energy Sectors

EclecticIQ cybersecurity researchers have uncovered a cyberespionage operation dubbed "Operation FlightNight" targeting Indian government...

WarzoneRAT Returns Post FBI Seizure: Utilizing LNK & HTA File

The notorious WarzoneRAT malware has made a comeback, despite the FBI's recent efforts to...

Google Revealed Kernel Address Sanitizer To Harden Android Firmware And Beyond

Android devices are popular among hackers due to the platform’s extensive acceptance and open-source...

Compromised SaaS Supply Chain Apps: 97% of Organizations at Risk of Cyber Attacks

Businesses increasingly rely on Software as a Service (SaaS) applications to drive efficiency, innovation,...

IT and security Leaders Feel Ill-Equipped to Handle Emerging Threats: New Survey

A comprehensive survey conducted by Keeper Security, in partnership with TrendCandy Research, has shed...

How to Analyse .NET Malware? – Reverse Engineering Snake Keylogger

Utilizing sandbox analysis for behavioral, network, and process examination provides a foundation for reverse...

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles