Azure CLI stores credentials in worse shape and allows cloud environment to be hacked

2023-11-14 21:31:39

CVE-2023-36052 is a critical security vulnerability in the Azure command-line interface (CLI), a tool for managing Azure resources. This vulnerability, reported by Palo Alto-based Prisma Cloud, allowed unauthenticated attackers to remotely access plain text content, including usernames and passwords, from continuous integration and continuous deployment (CI/CD) records created with the Azure CLI. These logs could be published by Azure DevOps and/or GitHub Actions. To mitigate this risk, users were recommended to update their Azure CLI to version 2.53.1 or higher.

Let’s consider a hypothetical example to understand the implications of CVE-2023-36052:

Let’s say a development team uses the Azure CLI to manage their Azure resources and automates their deployment process using GitHub Actions. During their routine operations, they run several Azure CLI commands that generate logs. These records, by default, include plain text credentials such as usernames and passwords.

An external attacker, aware of this vulnerability, could access the public repository where the team’s GitHub Actions are configured. By examining the CI/CD logs posted there, the attacker could find and extract these plaintext credentials. Using these credentials, the attacker could gain unauthorized access to the computer’s Azure resources, potentially leading to data breaches, unauthorized modifications, or even service interruptions.

This scenario underscores the critical nature of CVE-2023-36052, where seemingly benign logs could inadvertently become a source of major security breaches. Mitigation steps provided by Microsoft, including updating the Azure CLI and implementing best practices for log management and key rotation, are essential to prevent such unauthorized access.

Mitigation

Microsoft implemented several measures to address this vulnerability. These include:

Azure CLI update: Customers are recommended to update the Azure CLI to the latest version.

Records Protection: Avoid exposing Azure CLI output to publicly accessible logs or locations, and implement guidelines to mask environment variables.

Regular rotation of keys and secrets: Encourage regular rotation of keys and secrets.

Review of security best practices: Provides guidance on managing secrets for Azure services and GitHub actions, and ensures that GitHub repositories are private unless they need to be public.

Protecting Azure Pipelines: provides guidance for securing Azure Pipelines.

Improved default settings: Introducing new default settings in the Azure CLI to prevent accidental disclosure of sensitive information. This included restricting the presentation of secrets in the output of update commands and expanding credential redaction capabilities in GitHub Actions and Azure Pipelines.

Alternative solution

Without patches, the main alternative way to mitigate the risks associated with CVE-2023-36052 involves several best practices and security measures:

Secure Logging Practices: Make sure the logs do not contain sensitive information. This could involve custom scripts or tools to leak or obfuscate credentials and other sensitive data before it is recorded.

Record access control: Restrict access to CI/CD logs. Ensure that only authorized personnel can view these logs and that they are not publicly accessible.

Frequent credential rotation: Periodically change credentials and secrets to reduce the window of opportunity for an attacker to use compromised credentials.

Monitoring and alerts: Implement monitoring to detect unusual access patterns or credential usage, which could indicate a compromise.

Environment segmentation: Segregate development, test and production environments. Limit the scope of what each environment can access to minimize potential damage.

However, these measures are more complex and potentially less effective than updating the Azure CLI to a patched version. Patching directly addresses the vulnerability at its source, providing a more complete and simple solution.

He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cybersecurity analyst in 2003. He actively works as an antimalware expert. He also worked for security companies such as Kaspersky Lab. His daily work includes investigating new malware and cybersecurity incidents. He also has a deep level of knowledge in mobile security and mobile vulnerabilities.

Send news tips to [email protected] or www.instagram.com/iicsorg/

You can also find us on Telegram www.t.me/noticiasciberseguro