Microsoft patched a cloud security vulnerability within the Azure Automation service.
This “critical” permitted a cloud tenant to remotely gain access to, and take control of, resources and data. With Azure Automation, customers can queue jobs and manage input / output tasks, with each customer’s automation code running inside a sandbox, isolated from other customers’ code executing on the same virtual machine.
The “AutoWarp” vulnerability, which was initially uncovered by Orca Security, allows the bad actor to interact with an internal server to gain authentication tokens for other customer accounts. It is believed to only affect those with an activated Managed Identity feature.
Microsoft contacted all those potentially affected.
Additional information is available via the Microsoft Security Response Center.
