Critical Vulnerability in Azure Synapse Let Attackers Control other Customers’ Workspaces

The Microsoft Azure Synapse service has been identified as unsafe to use, and Orca Security has issued a security advisory for CVE-2022-29972. 

It was found that the integration runtime (IR) used by the Azure-affected services to connect to Amazon Redshift is vulnerable to this security hole in the third-party Open Database Connectivity (ODBC) data connector.

IR users, including multiple tenants, could have been affected by the flaw if a remote attacker exploited it. Here’s what Microsoft stated:-

“These certificates are specific to Azure Data Factory and Synapse Pipelines and do not pertain to the rest of Azure Synapse. The vulnerability could have allowed an attacker to perform remote command execution across IR infrastructure not limited to a single tenant.”

There was no evidence of exploitation of the vulnerability prior to the release of the patch, even though the vulnerability was mitigated on April 15.

Disclosure Timeline

Here below we have mentioned the timeline:-

• January 4: Orca reported the issue to Microsoft.
• March 2: Microsoft completed the rollout of the initial hotfix.
• March 11: Microsoft identified and notified the customer affected by the researcher’s activity.
• March 30: Orca notified Microsoft of an additional attack path to the same vulnerability.
• April 13: Orca notified Microsoft of a second attack path to the same vulnerability.
• April 15: Additional fixes deployed for the two newly reported attack paths as well as additional defense-in-depth measures applied.

Mitigation

To mitigate this problem, Azure cloud customers and on-premises customers with auto-updates enabled do not have to take any further steps. 

Azure Service Health Alerts are already letting Self-Hosted IR customers who don’t have auto-updates enabled on their deployments know that they should secure their deployments in order to prevent further issues.

On Microsoft’s Download Center, the company recommends the update of their self-hosted integrated reports (5.17.8154.2) to the most current version.

The “Customer Recommendations and Additional Support” section contains further information on how to mitigate CVE-2022-299.

Apart from this, 64-bit systems with the latest version of .NET Framework can install these updates, including the latest versions.

Azure’s security vulnerabilities have already been fixed twice in the past year, including by Microsoft in March. In December, a vulnerability was found, called AutoWarp, that allowed attackers to take complete control of another.

Wiz researchers also found Azure Cosmos DB, a software agent for Open Management Infrastructure (OMI), and Azure App Service to be vulnerable to the same vulnerabilities that Redmond patched up in the past year.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.