Summary
An exposed endpoint in the Azure Automation Service allowed to steal Azure
API credentials from other customers
Affected Services
Automation Service
Remediation
None required. As a general practice, use the least-privilege
principle, including on managed identities assigned to automation accounts. While
this would not have prevented the leakage of API credentials, it would have reduced
the blast radius.
Tracked CVEs
No tracked CVEs
References
Contributed by https://github.com/christophetd
Disclosure Date
Mon, Dec 6th, 2021
Exploitablity Period
-
Known ITW Exploitation
-
Detection Methods
-
Piercing Index Rating
9.46
(PI:1.5/A1:20/A2:1.21/A7:1.1/A8:1.1)
Discovered by
Yanir Tsarimi, Orca Security
