Summary
Azure Synapse Analytics and Azure Data Factory were vulnerable to cross-tenant access and code execution.
This was made possible via a combination of (1) a shell injection RCE vulnerability in the integration runtime,
(2) credentials for multiple customers stored on a shared host and (3) an insecure management server API.
Affected Services
Synapse Analytics, Data Factory
Remediation
None required
Tracked CVEs
CVE-2022-29972
References
https://orca.security/resources/blog/azure-synapse-analytics-security-advisory/https://orca.security/resources/blog/synlapse-critical-azure-synapse-analytics-service-vulnerability/https://msrc-blog.microsoft.com/2022/05/09/vulnerability-mitigated-in-the-third-party-data-connector-used-in-azure-synapse-pipelines-and-azure-data-factory-cve-2022-29972/
Contributed by https://github.com/0xdabbad00
Entry Status
Finalized
Disclosure Date
Tue, Jan 4th, 2022
Exploitablity Period
-
Known ITW Exploitation
-
Detection Methods
-
Piercing Index Rating
8.63
(PI:1.5/A1:22/A2:1/A7:1.1/A8:0.9)
Discovered by
Tzah Pahima, Orca Security
