Privilege Escalation in Microsoft Azure
summary
Demonstrates a practical escalation from Reader to full control by abusing legacy ARM API versions, using two discovery tricks: diffing operations APIs to find changed permission strings and calling undocumented endpoints. Exploits include the API Management user keys and a legacy SSO token endpoint (callable via management.azure-api.net) to create an “evil hackers API” and to obtain tokens that deploy functions — resulting in remote code execution on App Service. Some issues are patched, others remain; mitigations: disable old API versions, restrict management endpoints to VNet/private access, and remove exposed static keys.
AI-written summary · about
chapters (10)
- 0:00Privilege escalation in Azure
- 1:08ARM API focus
- 7:41ARM API and authorization
- 13:43Finding ARM API bugs
- 22:47API Management vulnerabilities
- 32:54Exploiting old API versions
- 36:26Live demo of API bugs
- 48:14App Services escalation
- 52:38Mitigation strategies
- 57:14Conclusion
related talks
51mAdvanced Attack Vectors in Azure Environments
38mAbusing Azure Active Directory: From MFA Bypass to Listing Global Administrators
38mAll You Need is Guest
38mHiding in the Clouds: Abusing Azure DevOps Services to Bypass Microsoft Sentinel Analytic Rules
55mAzure Attacks Unpacked: Real-World Threats & Lessons
49mAzure DevOps security - Lessons learned
52mUncovering Azure's Silent Threats: A Journey Into Cloud Vulnerabilities
09mThe dark art of OIDC abuse - A case study in Entra ID