Researchers Uncover XSS Vulnerabilities in Azure Services

Cybersecurity specialists at Orca Security have discovered two critical cross-web page scripting (XSS) vulnerabilities in Microsoft Azure companies.

The flaws, which exploited a weak point in the postMessage iframe, could have exposed Azure users to possible security breaches. 

The vulnerabilities were observed in Azure Bastion and Azure Container Registry – two normally utilised services in the Azure ecosystem. 

“Despite various Azure security enhancements to mitigate the postMessage iframe XSS vulnerability, we continue to managed to uncover two Azure expert services – Azure Bastion and Azure Container Registry – that were exploitable by means of this vulnerability,” Orca wrote in a report released today.

The initial of these lies in the mishandling of the postMessage handler, which authorized attackers to exploit three unique postMessage cases. 

By sending a specially crafted postMessage, attackers could execute destructive scripts, perhaps compromising person sessions and delicate info.

Meanwhile, the Azure Container Registry flaw allowed attackers to inject and execute arbitrary scripts within just the context of the container registry.

This enabled them to manipulate the behavior of the influenced web software and possibly steal delicate facts or execute unauthorized steps.

“The vulnerabilities allowed unauthorized access to the victim’s session within the compromised Azure service iframe, which can direct to critical effects, such as unauthorized data obtain, unauthorized modifications, and disruption of the Azure expert services iframes,” Orca wrote.

Go through more on XSS assaults: ConnectWise Fixes XSS Vulnerability that Could Lead to Remote Code Execution

The firm instantly claimed the vulnerabilities to Microsoft: “Upon discovery of these vulnerabilities, we right away informed the Microsoft Security Reaction Middle (MSRC), who were being capable to reproduce the issues.”

“Both vulnerabilities have now been set and confirmed – with no further more action essential by Azure users,” reads the report.

Its publication comes three months just after Orca Security disclosed information about a independent flaw in Microsoft’s Azure Provider Material Explorer (SFX) they referred to as “Super FabriXss.”

Editorial image credit score: Postmodern Studio / Shutterstock.com

Some parts of this article are sourced from:
www.infosecurity-journal.com