Researchers Detail Severe “Super FabriXss” Vulnerability in Microsoft Azure SFX

Mar 30, 2023Ravie LakshmananCloud Security / Vulnerability

Details have emerged about a now-patched vulnerability in Azure
Service Fabric Explorer (SFX^[1]) that could lead to
unauthenticated remote code execution.

Tracked as CVE-2023-23383^[2]
(CVSS score: 8.2), the issue has been dubbed “Super FabriXss” by
Orca Security, a nod to the FabriXss flaw^[3]
(CVE-2022-35829, CVSS score: 6.2) that was fixed by Microsoft in
October 2022.

“The Super FabriXss vulnerability enables remote attackers to
leverage an XSS vulnerability to achieve remote code execution on a
container hosted on a Service Fabric node without the need for
authentication,” security researcher Lidor Ben Shitrit said^[4]
in a report shared with The Hacker News.

XSS refers to a kind of client-side code injection^[5] attack that makes it
possible to upload malicious scripts into otherwise trusted
websites. The scripts then get executed every time a victim visits
the compromised website, thereby leading to unintended
consequences.

While both FabriXss and Super FabriXss are XSS flaws, Super
FabriXss has more severe implications in that it could be
weaponized to execute code and potentially gain control of
susceptible systems.

Super FabriXss, which resides in the “Events” tab associated
with each node in the cluster from the user interface, is also a
reflected XSS flaw, meaning the script is embedded into a link, and
is only triggered when the link is clicked.

“This attack takes advantage of the Cluster Type Toggle options
under the Events Tab in the Service Fabric platform that allows an
attacker to overwrite an existing Compose deployment by triggering
an upgrade with a specially crafted URL from XSS Vulnerability,”
Ben Shitrit explained.

“By taking control of a legitimate application in this way, the
attacker can then use it as a platform to launch further attacks or
gain access to sensitive data or resources.”

The flaw, according to Orca, impacts Azure Service Fabric
Explorer version 9.1.1436.9590 or earlier. It has since been
addressed by Microsoft as part of its March 2023 Patch Tuesday update^[6], with the tech giant
describing it as a spoofing vulnerability.

“The vulnerability is in the web client, but the malicious
scripts executed in the victim’s browser translate into actions
executed in the (remote) cluster,” Microsoft noted^[7]
in its advisory. “A victim user would have to click the stored XSS
payload injected by the attacker to be compromised.”

The disclosure comes as NetSPI revealed a privilege escalation flaw^[9] in Azure Function Apps,
enabling users with “read only” permissions to access sensitive
information and gain command execution.

It also follows the discovery of a misconfiguration in Azure
Active Directory that exposed a number of applications to
unauthorized access, including a content management system (CMS)
that powers Bing.com.

Cloud security firm Wiz, which codenamed the attack BingBang^[10], said it could be
weaponized to alter search results in Bing, and worse, even perform
XSS attacks on its users.