Microsoft fixes SSRF vulnerabilities found in Azure services

SSRF risks

Shitrit confirmed the four SSRF flaws are cloud vulnerabilities only and do not affect local software in Azure customer environments. He said the Azure services were misconfigured from the start, which created the conditions for SSRF attacks.

Even though the SSRF flaws found by Orca could be accessed without even an Azure account, the Azure bugs received lower severity ratings. Shitrit attributed that to Microsoft's countermeasures such as Digital Twins using specific URL prefixes. In the case of Azure Functions, it was almost impossible to reach IMDS.

In the blog post, he warned that accessing IMDS would expose "detailed information on instances, including hostname, security group, MAC address and user-data, allowing attackers to retrieve tokens, move to another host and execute code (RCE)."

"Thanks to various SSRF mitigations that Microsoft put in place, such as environment variable (X-IDENTITIY -HEADER), we did not manage to reach any IMDS endpoints. However, even without the ability to access IMDS services, there was still a lot of potential damage an attacker could achieve," he wrote in the blog.

Another factor to account for is all four flaws fell under the non-blind or full SSRF category. Essentially, an authenticated threat actor could gain complete communication with the server. Non-blind is one of three main types of SSRF attacks Shitrit highlighted in the blog. It is the only one that allows attackers to receive a full response from the server.

While that can increase the potential damage, Shitrit emphasized how crucial it is for enterprises to properly secure servers and networks to prevent any of the three attack types.

"It is important to note that no matter the type of SSRF attack, each SSRF vulnerability can be used to gain unauthorized access to sensitive information or launch further attacks against a target," Shitrit wrote.

Orca said the key to protecting against these attacks is ensuring that all input is properly validated and that servers are configured to only allow necessary inbound and outbound traffic. Additionally, Orca recommended proper cloud security hygiene, using the principle of least privilege access and patching vulnerabilities to limit attack damage.

Microsoft's response

Orca reported the flaws in four different Azure services to Microsoft beginning in October. They were all fixed within a month or so after disclosure. Orca applauded Microsoft for its swift response and for implementing measures in 2020 that "significantly reduced the potential damage of SSRF attacks on its Azure platform."

Addressing cloud vulnerabilities can be complicated even though fixes fall solely on the cloud provider and often require no user interaction. Because of that, cloud vulnerabilities are not assigned CVEs. Providers sometimes choose to silently patch the flaws without publicly disclosing the issues to customers.

Additionally, there have been complaints from security researchers regarding transparency when it comes to the disclosure of cloud vulnerabilities. In June, Tenable accused Microsoft of just that after it reported two Azure Synapse Analytics flaws, which took Microsoft months to fix. Later that month, Wiz launched a cloud database to increase the transparency and document any security issues and fixes for major cloud services.