Three new security flaws have been disclosed in Microsoft Azure API Management service that could be abused by malicious actors to gain access to sensitive information or backend services.
This includes two server-side request forgery (SSRF) flaws and one instance of unrestricted file upload functionality in the API Management developer portal, according to Israeli cloud security firm Ermetic.
“With the file upload path traversal, attackers could upload malicious files to Azure’s hosted internal workload.”
Azure API Management is a multicloud management platform that allows organizations to securely expose their APIs to external and internal customers and enable a wide range of connected experiences.
Of the two SSRF flaws identified by Ermetic, one of them is a bypass for a fix put in place by Microsoft to address a similar vulnerability reported by Orca earlier this year. The other vulnerability resides in the API Management proxy function.
Exploitation of SSRF flaws can result in loss of confidentiality and integrity, permitting a threat actor to read internal Azure resources and execute unauthorized code.
An authenticated user can leverage this loophole to upload malicious files to the developer portal server and potentially even execute arbitrary code on the underlying system.
The findings come weeks after researchers from Orca detailed a “by-design flaw” in Microsoft Azure could be exploited by attackers to gain access to storage accounts, move laterally in the environment, and even execute remote code.
It also follows the discovery of another Azure vulnerability dubbed EmojiDeploy that could enable an attacker to seize control of a targeted application.
Source: https://thehackernews.com/
