XSS Vulnerabilities Found in Microsoft Azure Cloud Services
Microsoft quickly issued patches for the two security issues, which could allow unauthorized access to cloud sessions.
Two cloud security vulnerabilities — in Azure Bastion and Azure Container Registry — were found in Microsoft Azure's services, which "allowed an attacker to achieve cross-site scripting (XSS) by using iframe-postMessages [and] allowed unauthorized access to the victim's session within the compromised Azure service iframe," according to Orca Security.
Orca notified the Microsoft Security Response Center (MSRC) immediately upon discovery of the bugs. MSRC was able to reproduce the issues after it was notified of the vulnerabilities' existence in order to patch and verify them.
Cross-site scripting (XSS) is an event in which a threat actor injects malicious scripts into a credible website, ultimately executed by users' browsers unknowingly. At that point, this can lead to severe consequences, noted Orca Security, as threat actors can gain unauthorized access, compromise network systems, or even steal data.
However, "these vulnerabilities require a victim to be lured into visiting a compromised endpoint that the malicious actor controls," commented David Lindner, CISO at Contrast Security, in an emailed statement. "Should Microsoft fix this? Most likely, but I would not call these severe by any means. If anyone gets lured into an attacker-controlled endpoint, all bets are off anyway."
The fixes were automatic, so no further action is required from Azure users, but they may want to look for signs of compromise.
About the Author(s)
You May Also Like
Is AI Identifying Threats to Your Network?
May 14, 2024Where and Why Threat Intelligence Makes Sense for Your Enterprise Security Strategy
May 15, 2024Safeguarding Political Campaigns: Defending Against Mass Phishing Attacks
May 16, 2024Why Effective Asset Management is Critical to Enterprise Cybersecurity
May 21, 2024Finding Your Way on the Path to Zero Trust
May 22, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024