Summary
An issue in Azure Cloud Shell could have allowed an attacker to take over
an Azure App Service domain and leverage it to inject and execute
commands in other tenants' terminals if they navigated to the domain while
logged into their account. Using this method, an attacker could query the
Azure IMDS on other tenants' behalf and thereby obtain their access tokens.
Affected Services
Cloud Shell
Remediation
None required.
Tracked CVEs
No tracked CVEs
References
Contributed by https://github.com/mer-b
Entry Status
Finalized
Disclosure Date
Sat, Aug 20th, 2022
Exploitablity Period
-
Known ITW Exploitation
-
Detection Methods
-
Piercing Index Rating
9.17
(PI:1.5/A1:22/A2:1.21/A7:0.9/A8:1.1)
Discovered by
Gafnit Amiga, Lightspin
