Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2021-42306 CredManifest: App Registration Certificates Stored in Azure Active Directory

netspi.com | vulnerability | CVE-2021-42306 | #cloud | #azure | #certificates | #azure-ad | #cve-2021-42306 | #credmanifest | #app-registration

Summary

CVE-2021-42306 CredManifest: Azure Automation 'Run as' PFX certificates were stored in cleartext in Azure AD App Registration manifests, letting most AAD users authenticate as Contributors.
CVE
CVE-2021-42306
Published
Collected

original ↗

Related coverage

vulnerability · netspi.com
XSS Using Active Directory Automatic Provisioning
Azure AD SCIM provisioning synced user names into a web app without output encoding, giving script injection via the firstName field and a path to steal credentials with an imported JS file.
blog · netspi.com
Get-AzurePasswords: Exporting Azure RunAs Certificates for Persistence
Karl Fosaaen starts an Azure Automation series, showing how runbook permissions allow attackers to export RunAs certificates and credentials for maintaining privileged access to Azure subscriptions.
blog · netspi.com
Running PowerShell on Azure VMs at Scale
Karl Fosaaen shows how Azure Contributor rights enable VM command execution as SYSTEM via Invoke-AzureRmVMRunCommand without opening firewall ports, scaling PowerShell across subscription VMs.
blog · netspi.com
Anonymously Enumerating Azure Services
Karl Fosaaen releases a script for anonymous Azure service enumeration, brute forcing DNS across azurewebsites.net, cloudapp.net, and blob.core.windows.net to map a target's public Azure footprint.
blog · netspi.com
Get-AzurePasswords: A Tool for Dumping Credentials from Azure Subscriptions
Karl Fosaaen introduces Get-AzurePasswords, a MicroBurst script that automates credential dumping from Azure Key Vaults, App Services configurations, and Automation Accounts via Azure PowerShell.
blog · netspi.com
Anonymously Enumerating Azure File Resources
Karl Fosaaen explores anonymous enumeration of Azure blob storage, explaining container access policies and releasing tooling to find publicly exposed blobs holding configs, backups, and credentials.
back