Microsoft Azure ‘AutoWarp’ Bug Could Have Let Attackers Access Customers’ Accounts

Details have been disclosed about a now-addressed critical
vulnerability in Microsoft’s Azure Automation^[1]
service that could have permitted unauthorized access to other
Azure customer accounts and take over control.

“This attack could mean full control over resources and data
belonging to the targeted account, depending on the permissions
assigned by the customer,” Orca Security researcher Yanir Tsarimi
said^[2]
in a report published Monday.

The flaw potentially put several entities at risk, including an
unnamed telecommunications company, two car manufacturers, a
banking conglomerate, and big four accounting firms, among others,
the Israeli cloud infrastructure security company added.

The Azure Automation service allows^[3]
for process automation, configuration management, and handling
operating system updates within a defined maintenance window across
Azure and non-Azure environments.

Dubbed “AutoWarp,” the issue affects all users
of the Azure Automation service that have the Managed Identity^[4]
feature turned on. It’s worth noting that this feature is enabled
by default. Following responsible disclosure on December 6, 2021,
the issue was remediated in a patch pushed on December 10,
2021.

“Azure Automation accounts that used Managed Identities tokens
for authorization and an Azure Sandbox for job runtime and
execution were exposed,” Microsoft Security Response Center (MSRC)
said^[5]
in a statement. “Microsoft has not detected evidence of misuse of
tokens.”

While the automation jobs are designed to be isolated by means
of a sandbox to prevent access by other code running on the same
virtual machine, the vulnerability made it possible for a bad actor
executing a job in an Azure Sandbox to obtain the authentication
tokens of other automation jobs.

“Someone with malicious intentions could’ve continuously grabbed
tokens, and with each token, widen the attack to more Azure
customers,” Tsarimi noted.

The disclosure comes nearly two months after Amazon Web Services
(AWS) fixed two vulnerabilities – dubbed Superglue^[6]
and BreakingFormation^[7]
– in the AWS Glue and CloudFormation services that could have been
abused to access data of other AWS Glue customers and leak
sensitive files.

In December 2021, Microsoft also resolved^[8]
another security weakness in the Azure App Service that resulted in
the exposure of source code of customer applications written in
Java, Node, PHP, Python, and Ruby for at least four years since
September 2017.