Warning: Microsoft Alerts Potential Exploitation of Azure Service Tags by Hackers
Microsoft cautions regarding the potential exploitation of Azure Service Tags by unauthorized users to counterfeit requests from a trusted service and circumvent firewall regulations, thereby enabling them to unlawfully access cloud resources.
The Microsoft Security Response Center (MSRC) stated in a recent guidance that, “This incident emphasizes an inherent danger in utilizing service tags as a singular method for evaluating incoming network traffic.”
“Service tags should not be considered as a security perimeter and must only be employed as a routing mechanism alongside validation checks. Service tags do not provide a comprehensive solution for securing traffic to a user’s source and cannot replace input validation to prevent vulnerabilities that might be linked with web requests.”
The statement was in response to the revelations from Tenable, a cybersecurity company, which discovered that Azure customers relying on Azure Service Tags for their firewall rules could be bypassed. There is no proof that this vulnerability has been exploited in real-world scenarios.
The core issue lies in some Azure services permitting inbound traffic through a service tag, which potentially enables an attacker in one tenant to send tailored web requests to access resources in another, provided it allows traffic from the service tag without conducting any form of authentication.
Ten Azure services have been identified as susceptible: Azure Application Insights, Azure DevOps, Azure Machine Learning, Azure Logic Apps, Azure Container Registry, Azure Load Testing, Azure API Management, Azure Data Factory, Azure Action Group, Azure AI Video Indexer, and Azure Chaos Studio.
“This flaw empowers a hacker to manage server-side requests, effectively masquerading as trusted Azure services,” mentioned Tenable researcher Liv Matan commented. “This allows the attacker to evade network restrictions based on Service Tags, typically employed to prevent unauthorized access to Azure clients’ internal assets, data, and services.”
In reaction to the disclosure in late January 2024, Microsoft has revised the documentation to explicitly mention that “Relying solely on Service Tags is insufficient for securing traffic without considering the service’s nature and the traffic it sends.”
It is also advised that customers review their utilization of service tags and verify that they have implemented adequate security measures to authenticate only trusted network traffic for service tags.
About Author
