Azure cross-tenant compromise flaws found
The gist
A security researcher disclosed five critical Azure Logic Apps API Connection flaws and Microsoft paid $200,000.
The bugs let one tenant reach another's backend services across tenant boundaries.
How it unfolded
- recentlyThe researcher achieved a first cross-tenant compromise using the DynamicInvoke endpoint with a path traversal payload, and the service returned a victim's Key Vault secret given only a valid ARM token.
- recentlyA couple of weeks after the report, the vulnerability was marked fixed; the researcher found the fix restricted allowed paths rather than the underlying token issue.
- recentlyAfter extracting code from a Standard Logic App's dedicated host, the researcher found the fix was a check for '../' sequences, and the same code search turned up four undocumented functions including DynamicList.