Orca recently conducted an investigation into several Microsoft Azure services and discovered four instances where various services were uncovered to be susceptible to a Server Side Request Forgery (SSRF) attack.
There are two certain weaknesses present in the Azure platform that is particularly concerning because they do not require any form of authentication to access or exploit.
This means that an attacker does not need to have a valid account or login credentials for the Azure platform in order to take advantage of these vulnerabilities.
This lack of authentication makes it much easier for an attacker to gain unauthorized access or perform malicious actions and increases the likelihood of a successful attack.
The use of the word “concerning” emphasizes the severity of this security concern and highlights the need for immediate action to address these vulnerabilities.
The security vulnerabilities discovered by Orca between October 8, 2022, and December 2, 2022, are in the following services:-
After discovering these vulnerabilities Orca promptly reported Microsoft Security Response Center (MSRC) about them. As a result, MSRC fixed the problems quickly and Microsoft confirmed that the vulnerabilities were no longer present.
Now, Orca is making the information about the vulnerabilities public, as they have been resolved. Below we have mentioned the general summary and the sequence of events of the vulnerabilities that were discovered in four Azure services.
Thankfully, the researchers’ attempts to exploit the SSRF vulnerabilities found in Azure were foiled, as Microsoft had already established various SSRF countermeasures within their cloud ecosystem, preventing access to IMDS endpoints.
In order to neutralize potential threats, organizations are urged to follow the actions that we have mentioned below:-
Network Security Checklist – Download Free E-Book
In the wake of the recent disclosure of a critical vulnerability (CVE-2024-3400) affecting a leading…
There is a wide variety of solutions one can use to investigate phishing attacks. Yet,…
Tor Browser 13.0.14 has been released, bringing essential security updates to the popular privacy-focused web…
The cybersecurity community is sounding the alarm about the growing risk of a "mobile NotPetya"…
Attackers tried to take over the JavaScript project from OpenJS Foundation, which is home to JavaScript…
Multiple Cloud Service providers like Google Cloud, AWS, and Azure have been discovered with a…