Microsoft Azure Services Vulnerable To SSRF

A Server-side request forgery (SSRF) attack is a type of attack that allows an attacker to manipulate a server to execute arbitrary HTTP requests on behalf of the server.

This can have serious consequences as it enables a malicious actor to read or update internal resources. Threat actors are then able to pivot to other parts of the network and breach otherwise unreachable systems to extract valuable data.

The four Azure Services with SSRF vulnerabilities are listed below:

1. On October 8, 2022, a weakness in the hosted Digital Twins Explorer was uncovered that could have allowed for SSRF attacks. This vulnerability was quickly addressed and a fix was released on October 17, 2022. To ensure the security of the service, Azure Digital Twins has implemented measures to prevent access to internal Azure services through IDMS and wire server.
2. On November 12, 2022, a weakness was exposed in the Azure Functions Service. This SSRF vulnerability could have enabled unauthenticated users to craft specific URLs, which in turn could have given attackers the ability to gather information about local ports. Microsoft released a solution on December 9, 2022.
3. A weakness in Azure API Management Service was exposed also on November 12, 2022, allowing a malicious actor the potential to exploit loopback URLs and abuse the server. Swift action was taken by the APIM engineering team, releasing a fix to block access to local ports and resources on the VM by November 16, 2022.
4. The machine learning service was hit with an SSRF vulnerability on December 2, 2022, however, it was deemed a low risk as it failed to expose any confidential information or tokens and did not grant access to sensitive internal endpoints. The vulnerability was patched on December 20, 2022.

Two of the vulnerabilities were found in Azure Functions and Azure Digital Twins and could be exploited without requiring any authentication, allowing a threat actor to seize control of a server without even having an Azure account.

Three of the flaws were rated as “Important” in severity, while one was rated as “Low.”

However, all the weaknesses could be leveraged to manipulate a server to mount further attacks against a susceptible target.