Monday, June 16, 2025
HomeVulnerabilityCritical Vulnerability in Azure Synapse Let Attackers Control other Customers’ Workspaces

Critical Vulnerability in Azure Synapse Let Attackers Control other Customers’ Workspaces

Published on

SIEM as a Service

Follow Us on Google News

The Microsoft Azure Synapse service has been identified as unsafe to use, and Orca Security has issued a security advisory for CVE-2022-29972. 

It was found that the integration runtime (IR) used by the Azure-affected services to connect to Amazon Redshift is vulnerable to this security hole in the third-party Open Database Connectivity (ODBC) data connector.

IR users, including multiple tenants, could have been affected by the flaw if a remote attacker exploited it. Here’s what Microsoft stated:-

- Advertisement - Google News

“These certificates are specific to Azure Data Factory and Synapse Pipelines and do not pertain to the rest of Azure Synapse. The vulnerability could have allowed an attacker to perform remote command execution across IR infrastructure not limited to a single tenant.”

There was no evidence of exploitation of the vulnerability prior to the release of the patch, even though the vulnerability was mitigated on April 15.

Disclosure Timeline

Here below we have mentioned the timeline:-

  • January 4: Orca reported the issue to Microsoft.
  • March 2: Microsoft completed the rollout of the initial hotfix.
  • March 11: Microsoft identified and notified the customer affected by the researcher’s activity.
  • March 30: Orca notified Microsoft of an additional attack path to the same vulnerability.
  • April 13: Orca notified Microsoft of a second attack path to the same vulnerability.
  • April 15: Additional fixes deployed for the two newly reported attack paths as well as additional defense-in-depth measures applied.

Mitigation

To mitigate this problem, Azure cloud customers and on-premises customers with auto-updates enabled do not have to take any further steps. 

Azure Service Health Alerts are already letting Self-Hosted IR customers who don’t have auto-updates enabled on their deployments know that they should secure their deployments in order to prevent further issues.

On Microsoft’s Download Center, the company recommends the update of their self-hosted integrated reports (5.17.8154.2) to the most current version.

The “Customer Recommendations and Additional Support” section contains further information on how to mitigate CVE-2022-299.

Apart from this, 64-bit systems with the latest version of .NET Framework can install these updates, including the latest versions.

Azure’s security vulnerabilities have already been fixed twice in the past year, including by Microsoft in March. In December, a vulnerability was found, called AutoWarp, that allowed attackers to take complete control of another.

Wiz researchers also found Azure Cosmos DB, a software agent for Open Management Infrastructure (OMI), and Azure App Service to be vulnerable to the same vulnerabilities that Redmond patched up in the past year.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Kali Linux 2025.2 Released: New Tools, Smartwatch and Car Hacking Added

Kali Linux, the preferred distribution for security professionals, has launched its second major release...

Arsen Launches AI-Powered Vishing Simulation to Help Organizations Combat Voice Phishing at Scale

Arsen, the cybersecurity startup known for defending organizations against social engineering threats, has announced...

NIST Releases New Guide – 19 Strategies for Building Zero Trust Architectures

The National Institute of Standards and Technology (NIST) has released groundbreaking guidance to help...

Spring Framework Flaw Enables Remote File Disclosure via “Content‑Disposition” Header

A medium-severity reflected file download (RFD) vulnerability (CVE-2025-41234) in VMware's Spring Framework has been...

Credential Abuse: 15-Min Attack Simulation

Credential Abuse Unmasked

Credential abuse is #1 attack vector in web and API breaches today (Verizon DBIR 2025). Join our live, 15-min attack simulation with Karthik Krishnamoorthy (CTO - Indusface) and Phani Deepak Akella (VP of Marketing - Indusface) to see hackers move from first probe to full account takeover.

Discussion points


Username & email enumeration – how a stray status-code reveals valid accounts.
Password spraying – low-and-slow guesses that evade basic lockouts.
Credential stuffing – lightning-fast reuse of breach combos at scale.
MFA / session-token bypass – sliding past second factors with stolen cookies.

More like this

Spring Framework Flaw Enables Remote File Disclosure via “Content‑Disposition” Header

A medium-severity reflected file download (RFD) vulnerability (CVE-2025-41234) in VMware's Spring Framework has been...

Microsoft Defender Spoofing Flaw Enables Privilege Escalation and AD Access

A newly disclosed spoofing vulnerability (CVE-2025-26685) in Microsoft Defender for Identity (MDI) enables unauthenticated...

Amazon Cloud Cam Flaw Allows Attackers to Intercept and Modify Network Traffic

A critical vulnerability (CVE-2025-6031) has been identified in Amazon Cloud Cam devices, which reached...