Share news article

Share on facebook
Share on twitter
Share on linkedin
Share on email

Researchers Detail Azure SFX Flaw That Could've Allowed Attackers to Gain Admin Access

Cybersecurity researchers have shared more details about a now-patched security flaw in Azure Service Fabric Explorer (SFX) that could potentially enable an attacker to gain administrator privileges on the cluster.

The vulnerability, tracked as CVE-2022-35829, carries a CVSS severity rating of 6.2 and was addressed by Microsoft as part of its Patch Tuesday updates last week.

Orca Security, which discovered and reported the flaw to the tech giant on August 11, 2022, dubbed the vulnerability FabriXss (pronounced “fabrics”). It impacts Azure Fabric Explorer version 8.1.316 and prior.

SFX is described by Microsoft as an open-source tool for inspecting and managing Azure Service Fabric clusters, a distributed systems platform that’s used to build and deploy microservices-based cloud applications.

The vulnerability is rooted in the fact that a user with permissions to “Create Compose Application” through the SFX client can leverage the privileges to create a rogue app and abuse a stored cross-site scripting (XSS) flaw in the “Application name” field to slip the payload.

Armed with this exploit, an adversary can send the specially crafted input during the application creation step, eventually leading to its execution.

“This includes performing a Cluster Node reset, which erases all customized settings such as passwords and security configurations, allowing an attacker to create new passwords and gain full Administrator permissions,” Orca Security researchers Lidor Ben Shitrit and Roee Sagi said.

Found this article interesting? Follow THN on Facebook, Twitter and LinkedIn to read more exclusive content we post.

Related News

New Backdoor Attack Uses Russian-Ukrainian Conflict Phishing Emails

New Backdoor Attack Uses Russian-Ukrainian Conflict Phishing Emails

The primary targets of this phishing campaign are located in the Ukrainian regions of Crimea, Donetsk, and Lugansk, which were…
CyberSecure Announces Strategic Alliance

CyberSecure Announces Strategic Alliance

BETHESDA, Md., March 24, 2023 /PRNewswire/ — Cybersecure IPS and LockDown Inc. jointly announce that they have entered a strategic alliance to…
Tesla Model 3 Hacked in Less Than 2 Minutes at Pwn2Own Contest

Tesla Model 3 Hacked in Less Than 2 Minutes at Pwn2Own Contest

Researchers from France-based pen-testing firm Synacktiv demonstrated two separate exploits against the Tesla Model 3 this week at the Pwn2Own…