5 ms·

Taking over Azure DevOps accounts with one click

118 points by infosecau 6y ago

eganist 6y ago
That bounty is an order of magnitude smaller than it should've been. It's an account takeover defect that most anyone could fall for because of the structure of the payload URL.
- chickenpotpie 6y ago
  Probably makes a lot of less than ethical security researchers wonder if maybe they should do something else with the knowledge of the vulnerability next time
- donmcronald 6y ago
  And it’s shocking they’re able to add a DNS zone for a domain they don’t own. That alone is a massive issue for the email phishing potential. The combination is stunning. From: bob@project-cascade.visualstudio.com SPF: pass DKIM: pass DMARC: none “Hi it’s Bob from Project Cascade. We’re giving away Azure credits to anyone who used our trial in 2019 or earlier. Visit project-cascade.visualstudio.com/credits to check if you’re eligible.” Click. “Sorry, you’re not eligible.” I’d fall for that :-(
  - gravitas 6y ago
    In all the cloud provider DNS services I've used you can add a zone for anything with no verification of ownership. The root cause flaw is the domain owner allowing their registrar data to go stale and let NS point at a shared service where they did not own/host the records.
lmeyerov 6y ago
FWIW, we've had a lot of fun doing web inventory mapping via OWASP OMASS (https://github.com/OWASP/Amass https://github.com/OWASP/Amass): enumerate via amass -> dump into neo4j or just csv/json -> explore with jupyter/graphistry. A lot of bug bounties have been getting paid out this way. I can't share the details, but we did it as a graph analytics demo with a financial partner bigger than many countries, and 30min later, tickets filed. IMO every sec team > 5 people should have something like this setup.
marshallford 6y ago
Does the $3000 (USD?) bounty seem low to anyone else? Prior to reading the timeline section at the bottom of the post I would have guessed a range of 25k to 50k as a bounty for such a severe vulnerability.
- nicolas_t 6y ago
  Yes, it's way too low. Seeing companies cheapen out on bug bounties makes me feel less secure about them. It shows that they don't believe in the importance of security, provides less incentives for ethical hackers to find security issues and it means that less ethical hackers will be that much more tempted to use vulnerabilities they've found unethically.
- lalos 6y ago
  Don't know the range of their bounty program but seems like this exploit is circumstantial on finding a subdomain which was left hanging. Once they registered that subdomain on their own account, this exploit seizes to be effective by third parties so reproducibility is minimal (subdomain can be registered once). Unless you plan to sell the exploit once to one client or just re-use it once at a time by selling access to it (too much trouble, centralized risk).
  - kjaftaedi 6y ago
    It's not about reproducibility but severity and value. Offering low bounties for something like this can act as an incentive for people who find something like this to sell it somewhere else. A bug like this would be orders of magnitude more valuable in the wrong hands.
    - psds2 6y ago
      How can a low bounty act as an incentive?
      - kjaftaedi 6y ago
        This attack could have been used to gain access to any Azure account. If you knew that Microsoft would pay you a couple thousand for this and the black market would offer hundreds of thousands of dollars. It could influence a decision to not report the vulnerability to the developer.
tcmb 6y ago
Being awarded a bug bounty suggests that there was a bug that was fixed. But this was actually a misconfiguration, wasn't it? Any Azure account with a dangling subdomain and unrestricted reply-to is still vulnerable to this attack, correct?
- Someone1234 6y ago
  This critique seems to rely on an undefined definition of the terms "misconfiguration" and "bug." Reply-to is a bug. But it might be a configuration fix, as opposed to code fix. But without knowing how it is implemented we cannot say. And maybe more importantly the boundary between misconfiguration bugs and code bugs is irrelevant from an outsider's perspective. How reply-to is implemented is irreverent, the result is identical.
  - tcmb 6y ago
    The distinction is relevant from the perspective of any other customer on Azure. A code fix would have fixed the problem for them, too, A fixed config fixes the problem for visualstudio.com only. That's what I was getting at.
lowwave 6y ago
It is kind funny (or click-baitish) articles with "one click" seems. From a developer point of view, pretty much anything can be done with just one click.
- Liquid_Fire 6y ago
  The point is that it requires just one click (on a link) from the target user to steal their credentials, which is relatively easy to convince people to do, as opposed to a more complicated sequence of steps.
magma17 6y ago
stupid user action is needed, so it's not a critical bug.

118 points by infosecau 6y ago

That bounty is an order of magnitude smaller than it should've been. It's an account takeover defect that most anyone could fall for because of the structure of the payload URL.

chickenpotpie 6y ago
Probably makes a lot of less than ethical security researchers wonder if maybe they should do something else with the knowledge of the vulnerability next time
donmcronald 6y ago
And it’s shocking they’re able to add a DNS zone for a domain they don’t own. That alone is a massive issue for the email phishing potential. The combination is stunning. From: bob@project-cascade.visualstudio.com SPF: pass DKIM: pass DMARC: none “Hi it’s Bob from Project Cascade. We’re giving away Azure credits to anyone who used our trial in 2019 or earlier. Visit project-cascade.visualstudio.com/credits to check if you’re eligible.” Click. “Sorry, you’re not eligible.” I’d fall for that :-(
- gravitas 6y ago
  In all the cloud provider DNS services I've used you can add a zone for anything with no verification of ownership. The root cause flaw is the domain owner allowing their registrar data to go stale and let NS point at a shared service where they did not own/host the records.

lmeyerov 6y ago

FWIW, we've had a lot of fun doing web inventory mapping via OWASP OMASS (https://github.com/OWASP/Amass https://github.com/OWASP/Amass): enumerate via amass -> dump into neo4j or just csv/json -> explore with jupyter/graphistry. A lot of bug bounties have been getting paid out this way. I can't share the details, but we did it as a graph analytics demo with a financial partner bigger than many countries, and 30min later, tickets filed. IMO every sec team > 5 people should have something like this setup.

marshallford 6y ago

Does the $3000 (USD?) bounty seem low to anyone else? Prior to reading the timeline section at the bottom of the post I would have guessed a range of 25k to 50k as a bounty for such a severe vulnerability.

nicolas_t 6y ago
Yes, it's way too low. Seeing companies cheapen out on bug bounties makes me feel less secure about them. It shows that they don't believe in the importance of security, provides less incentives for ethical hackers to find security issues and it means that less ethical hackers will be that much more tempted to use vulnerabilities they've found unethically.
lalos 6y ago
Don't know the range of their bounty program but seems like this exploit is circumstantial on finding a subdomain which was left hanging. Once they registered that subdomain on their own account, this exploit seizes to be effective by third parties so reproducibility is minimal (subdomain can be registered once). Unless you plan to sell the exploit once to one client or just re-use it once at a time by selling access to it (too much trouble, centralized risk).
- kjaftaedi 6y ago
  It's not about reproducibility but severity and value. Offering low bounties for something like this can act as an incentive for people who find something like this to sell it somewhere else. A bug like this would be orders of magnitude more valuable in the wrong hands.
  - psds2 6y ago
    How can a low bounty act as an incentive?
    - kjaftaedi 6y ago
      This attack could have been used to gain access to any Azure account. If you knew that Microsoft would pay you a couple thousand for this and the black market would offer hundreds of thousands of dollars. It could influence a decision to not report the vulnerability to the developer.

tcmb 6y ago

Being awarded a bug bounty suggests that there was a bug that was fixed. But this was actually a misconfiguration, wasn't it? Any Azure account with a dangling subdomain and unrestricted reply-to is still vulnerable to this attack, correct?

Someone1234 6y ago
This critique seems to rely on an undefined definition of the terms "misconfiguration" and "bug." Reply-to is a bug. But it might be a configuration fix, as opposed to code fix. But without knowing how it is implemented we cannot say. And maybe more importantly the boundary between misconfiguration bugs and code bugs is irrelevant from an outsider's perspective. How reply-to is implemented is irreverent, the result is identical.
- tcmb 6y ago
  The distinction is relevant from the perspective of any other customer on Azure. A code fix would have fixed the problem for them, too, A fixed config fixes the problem for visualstudio.com only. That's what I was getting at.

lowwave 6y ago

It is kind funny (or click-baitish) articles with "one click" seems. From a developer point of view, pretty much anything can be done with just one click.

Liquid_Fire 6y ago
The point is that it requires just one click (on a link) from the target user to steal their credentials, which is relatively easy to convince people to do, as opposed to a more complicated sequence of steps.

magma17 6y ago

stupid user action is needed, so it's not a critical bug.