READWRITE APP SERIES

There are several steps you should take, as a defender, to ensure these attack paths do not exist in your Azure environment: Step 1: Audit and Remove Privileges Held by Service Principals Now that we have this JWT we can authenticate to MS Graph as the Service Principal, gaining any privileges held by that Service Principal. We’ll say that our name is “David” in the “Input” tab and submit the request: We can test the workflow right here in the GUI. When the Logic App receives a POST to that URL, it will then take the “name” input and return a body saying, “Hello, !” In this Logic App I’m using the visual designer to first define a trigger - an HTTP POST, in this example. Workflows are comprised of triggers and actions that occur as a result of those triggers. Admins can use Logic Apps to construct what are called “workflows”. Logic Apps are another Azure service falling under the general umbrella of “ Azure Automation”.

Christopher Brumm wrote a very good, very in-depth post all about the security considerations surrounding Logic Apps in February of 2021.

Josh Magri reported a serviceable privilege escalation vulnerability involving Logic Apps to MSRC in March of 2022.

Josh Magri wrote all about various ways to abuse both Reader and Contributor level rights against a Logic App in August of 2021.

Prior work involving abusing or exploiting Logic Apps:

READWRITE APP SERIES

In this series we will explore how those attack paths emerge, how they can be practically abused by an attacker, and how we as defenders can discover, mitigate, and prevent the future emergence of those attack paths. You should absolutely be using Managed Identity assignments in Azure instead of storing or accessing credentials.īut Managed Identities introduce a new problem: they can quickly create identity-based attack paths in Azure that may lead to escalation of privilege opportunities.

Instead of storing and sending credentials, Azure knows that your script is allowed to authenticate as a specific Service Principal. Managed Identity assignments are an extremely effective security control that prevent the accidental exposure of credentials by removing this requirement to store or use credentials in the first place.

In Part 1 we looked at how attack paths emerge out of Automation Account configurations. In this three part blog series we are exploring attack paths that emerge out of Managed Identity assignments in three Azure services: Automation Accounts, Logic Apps, and Function Apps. Managed Identity Attack Paths, Part 2: Logic Apps Intro and Prior Work

Readwrite app