By Elizabeth Montalbano
Three vulnerabilities in the platform’s API Management Service could allow access sensitive data, mount further attacks, and even hijack developer portals.

Microsoft has patched three vulnerabilities in its Azure cloud platform that could have allowed attackers to access sensitive info on a targeted service, deny access to the server, or scan the internal network to mount further attacks, researchers have found.

Researchers from the Ermetic Research Team discovered the flaws in the Azure API Management Service, which allows organizations to create, manage, secure, and monitor APIs across all of their environments, they revealed in a blog post published May 4.

The flaws — all rated high-risk — include two Server-Side Request Forgery (SSRF) vulnerabilities and a file upload path traversal on an internal Azure workload.

SSRF allows an attacker to send a crafted request from a vulnerable server to a targeted external or internal server or service, or even target it in a denial-of-service (DoS) attack. Abusing these flaws means an attacker can access sensitive data stored on the targeted server, overload targeted servers using DoS attacks, and scan the internal network and identify potential targets for further attacks.

The third flaw is one in which Azure does not validate the file type and path of uploaded files. Typically in the case of this type of flaw, authenticated users can traverse the path specified to upload malicious files to the developer portal server and possibly execute code on it using DLL hijacking, IISNode config swapping, or any other similar attack vectors, the researchers said.

Microsoft responded quickly to Ermetic’s disclosure of the flaws and has fully patched them, according to the researchers, and no further action is necessary for Azure customers.
Details on the Bugs

Specifically, the Ermetic researchers discovered two separate SSRF flaws: one that affected the Azure API Management CORS Proxy and another that affected the Azure API Management Hosting Proxy.

They discovered the former on Dec. 21, 2022, and at first believed it was the same flaw that was first reported to Microsoft by another cloud security company on Nov. 12, and fixed a few days later on Nov. 16. However, the researchers later realized that the flaw they found actually bypasses that initial fix. Microsoft ultimately patched the vulnerability fully in January, the initial researchers reported later, according to Ermetic.

Together, the Azure SSRF flaws that researchers discovered affected central servers that “masses of users and organizations depend on for day-to-day operations,” says Liv Matan, cloud security researcher at Ermetic.

“Using them, attackers could fake requests from these legitimate servers, access internal services that may contain sensitive information belonging to Azure customers, and even prevent the availability of the vulnerable servers,” he says.

The path-traversal flaw found in Azure API Management Service allowed for an unrestricted file upload to the Azure developer portal server, the researchers said. The developer portal’s authenticated mode allowed someone to upload static files and images that would be shown on a developer’s dedicated portal, they said.

The flaw could have allowed attackers to take advantage of Microsoft’s self-hosted developer portal as well as weaponize the vulnerability against end users, Matan explains.

“Additionally, the Azure-hosted developer portal contains customer information that would have been at risk if the vulnerability had fallen into the wrong hands,” he says.
How to Protect the Enterprise

While API flaws like the ones Ermetic researchers discovered are uncommon, awareness of these types of vulnerabilities has grown in the past few years, Matan says.

Moreover, “blind SSRFs” — SSRF flaws that do not necessarily return any data but rather focus on performing unauthorized actions on the server’s backend — are fairly common, especially in cloud platforms that offer a wide range of services, he says.

Microsoft already had previously patched four SSRF flaws in four separate services of its Azure cloud platform, two of which could have allowed attackers to perform a server-side request forgery (SSRF) attack — and thus potentially execute remote code execution — even without authentication to a legitimate account.

“In the end, vulnerabilities can be discovered in any cloud platform, at any time,” Matan says.

There’s certainly been evidence of this, as — aside from SSRF flaws — researchers already have found a number of other flaws in Azure as well as other cloud platforms that could have threatened enterprise environments.

In one instance, Microsoft patched what researchers called a “dangerous” flaw in its Azure Service Fabric component that, if exploited, would have allowed an unauthenticated, malicious actor to execute code on a container hosted on the platform.

Because it’s difficult for an enterprise deploying a cloud to have control over or even be aware of a flaw on the underlying cloud-hosting infrastructure, it’s important for organizations to be vigilant in their own security practices so they are prepared if a flaw is eventually discovered or exploited, the researchers said.

In the case of avoiding compromising in the recently discovered Azure API Management, Matan recommends that organizations should practice proper input-validation hygiene and configure their servers to not follow redirects.

“To avoid a compromise in these cases, organizations should validate all input received from untrusted sources, such as user inputs or HTTP requests,” he says.

Other steps organizations can take to avoid compromise in these cases, Matan adds, include using a whitelist approach, implementing a strong firewall to restrict outgoing traffic from the application to only necessary services and ports, isolating data, and managing permissions on the server in cloud environments using IMDSv2.

Link (https://www.darkreading.com/cloud/microsoft-patches-serious-azure-cloud-security-flaws?_mc=NL_DR_EDT_DR_weekly_20230504&cid=NL_DR_EDT_DR_weekly_20230504&sp_aid=116363&elq_cid=34964379&sp_eh=949bacdba1e2c4851acc11df0ff47140b1c6468716621bc723fe5fe498198bd9&sp_eh=949bacdba1e2c4851acc11df0ff47140b1c6468716621bc723fe5fe498198bd9&sp_cid=48484)

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Axcient
“Where Service and Technical Skills Count”

Does this surprise you???
By Bill Toulas March 9, 2023

Microsoft’s Security Intelligence team recently investigated a business email compromise (BEC) attack and found that attackers move rapidly, with some steps taking mere minutes.

The whole process, from signing in using compromised credentials to registering typosquatting domains and hijacking an email thread, took the threat actors only a couple of hours.

This rapid attack progression ensures that the targets will have minimal opportunity to identify signs of fraud and take preventive measures.

A multi-billion problem

BEC attacks are a type of cyberattack where the attacker gains access to an email account of the target organization through phishing, social engineering, or buying account credentials on the dark web.

The attacker then impersonates a trusted individual, such as a senior executive or a supplier, to trick an employee working in the financial department into approving a fraudulent wire transfer request.

According to FBI data, from June 2016 until July 2019, BEC attacks resulted in losses amounting to over $43 billion, and this concerns only the cases reported to the law enforcement agency.

In a Twitter thread, Microsoft’s analysts explain that a recently investigated BEC attack began with the threat actor performing an “adversary-in-the-middle” (AiTM) phishing attack to steal the target’s session cookie, bypassing MFA protection.

The attacker logged in to the victim’s account on January 5, 2023, and spent two hours searching the mailbox for good email threads to hijack.

Thread hijacking is a very effective technique making it appear that the fraudulent message is a continuation of an existing communication exchange, so the recipients are far more likely to trust it.

After that, the attacker registered deceptive domains using homoglyph characters to make them appear almost identical to the sites of the target organization and the impersonated partner.

Five minutes later, the attacker created an inbox rule to siphon emails from the partner organization to a specific folder.

In the next minute, the attacker sent the malicious email to the business partner asking for a wire transfer instruction change and immediately deleted the sent message to reduce the likelihood of the compromised user discovering the breach.

From the first sign-in to the deletion of the sent email, a total of 127 minutes had passed, reflecting a rush from the attacker’s side.

Microsoft 365 Defender generated a warning about BEC financial fraud 20 minutes after the threat actor deleted the sent email and automatically disrupted the attack by disabling the user’s account.
Progression of the attack blocked by Microsoft
Progression of the attack blocked by MS 365 Defender (Microsoft)

“In our testing and evaluation of BEC detections and actions in customer environments faced with real-world attack scenarios, dozens of organizations were better protected when accounts were automatically disabled by Microsoft 365 Defender,” claims Microsoft.

“The new automatic disruption capabilities leave the SOC team in full control to investigate all actions taken by Microsoft 365 Defender and where needed, heal any remaining, affected assets.”

Microsoft says its security product has disrupted 38 BEC attacks targeting 27 organizations using high-confidence eXtended Detection and Response (XDR) signals across endpoints, identities, email, and SaaS apps.

Article (https://www.bleepingcomputer.com/news/security/microsoft-business-email-compromise-attacks-can-take-just-hours/)

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Axcient
“Where Service and Technical Skills Count”