Microsoft Azure Migrate information disclosure

Summaryinfo

A vulnerability identified as problematic has been detected in Microsoft Azure Migrate, Azure Site Recovery, Azure Active Directory and Azure Automation. This affects an unknown function. The manipulation leads to information disclosure. This vulnerability is uniquely identified as CVE-2021-42306. The attack is possible to be carried out remotely. No exploit exists. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability was found in Microsoft Azure Migrate, Azure Site Recovery, Azure Active Directory and Azure Automation (Cloud Software) (affected version not known). It has been rated as problematic. This issue affects some unknown functionality. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. The summary by CVE is:

An information disclosure vulnerability manifests when a user or an application uploads unprotected private key data as part of an authentication certificate keyCredential  on an Azure AD Application or Service Principal (which is not recommended). This vulnerability allows a user or service in the tenant with application read access to read the private key data that was added to the application. Azure AD addressed this vulnerability by preventing disclosure of any private key values added to the application. Microsoft has identified services that could manifest this vulnerability, and steps that customers should take to be protected. Refer to the FAQ section for more information. For more details on this issue, please refer to the MSRC Blog Entry.

The weakness was disclosed 11/24/2021. The advisory is shared at portal.msrc.microsoft.com. The identification of this vulnerability is CVE-2021-42306 since 10/12/2021. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Applying a patch is able to eliminate this problem.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Cloud Software

Vendor

• Microsoft

Name

• Azure Active Directory
• Azure Automation
• Azure Migrate
• Azure Site Recovery

License

• commercial

Website

• Vendor: https://www.microsoft.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion