Azure App Security Series — Part7 — Managed Identities and abuse scenario

Photo by Towfiqu barbhuiya on Unsplash

• Azure provides the ability to assign identities to resources like app service, function apps , VMs etc.
• These identities will be assumed by these resources to access other resources such as Azure Key vault, Azure SQL.
• The managed identity can be of 2 types — system-assigned and user-assigned.
• System-Assigned managed identity is tied to a resource — and follow the lifecycle of that resource. For example, identity assigned to a VM will be deleted once the VM is deleted.
• User-Assigned managed identity can be created separately and assigned to multiple resources.

Abuse Scenario for Managed Identities -

• Resources such as Function App, Azure App Service are targets to hunt for Managed Identities.

• If in any case we get command execution on these resources such as App Service, Function apps, then it is possible to extract 2 important environment variables. These variables are set in the VM instance running these resource.

• The environment variables are — Identity_endpoint and Identity_header. If we find these environment variables, then that would indicate the app service is assigned a managed identity.

• Once we have these values, we can use curl / any web request command to request an access token for that managed identity.

• As we know that these managed identities can be assigned roles to access other resources. As soon as we capture the token, we can use that to access the resources that this managed identity has access to.

In the below images / screenshots, we see how a vulnerable app service ( web app ) could be used to extract access tokens using its managed identity.

a) We find a vulnerable input that enables command execution

b) We can use set / env commands in Windows / Linux environments to list the environment variables to find if the app services has got a managed identity.

c) Once we know this information, we can use curl command to extract the access token.

d) We have the access token.

e) We can use this token to authenticate to Azure using connect-azaccount PS command.

f) Once we have authenticated, we have assumed the identity of that app services and any role assigned to that app service can be used to perform actions.

g) In this example, the managed identity has access to read key vault resource.

Conclusion:

Ensure that the app services / web apps that we deploy are thoroughly verified for vulnerabilities.

Use principle of least privilege for managed identities.

Monitor the environment for suspicious activities.

List of my other stories — https://medium.com/@bloggertech927 Link to CAWASP -https://www.alteredsecurity.com/azureappsec