XSS Flaw in Azure Services
Share this:
Researchers identified two cloud related vulnerabilities in Azure Bastion and Azure Container Registry, which allowed an attacker to achieve cross-site scripting by using iframe-postMessages [and] allowed unauthorized access to the victim’s session within the compromised Azure service iframe
Cross-site scripting (XSS) is an event in which a threat actor injects malicious scripts into a credible website, ultimately executed by users’ browsers unknowingly. At that point, this can lead to severe consequences, noted Orca Security, as threat actors can gain unauthorized access, compromise network systems, or even steal data.
Attack Flow
- Reconnaissance
- Endpoint Misconfiguration
- Exploiting the Misconfigured Endpoint
- Analyzing Legitimate postMessages
- Debugging and Identifying Vulnerable Code
- Crafting the Exploitative Payload
- Delivery and Execution
- Exploitation Consequences
By understanding these steps, organizations can strengthen their security measures and protect against other postMessage iframe vulnerabilities in Azure services.
Researchers notified the Microsoft Security Response Center (MSRC) immediately upon discovery of the bugs. MSRC was able to reproduce the issues after it was notified of the vulnerabilities’ existence in order to patch and verify them.
These vulnerabilities require a victim to be lured into visiting a compromised endpoint that the malicious actor controls.
