Microsoft Azure flaws could allow accessing PostgreSQL DBs of other customers

Researchers discovered flaws in the Azure Database for PostgreSQL Flexible Server that could result in unauthorized cross-account database access in a region.

Microsoft addressed a couple of vulnerabilities impacting the Azure Database for PostgreSQL Flexible Server that could result in unauthorized cross-account database access in a region.

The vulnerabilities were discovered by researchers at cloud cybersecurity firm Wiz that reported them to the IT giant under Coordinated Vulnerability Disclosure (CVD).

“Wiz Research has discovered a chain of critical vulnerabilities in the widely used Azure Database for PostgreSQL Flexible Server. Dubbed #ExtraReplica, this vulnerability allows unauthorized read access to other customers’ PostgreSQL databases, bypassing tenant isolation.” reads the analysis published by Wiz. “If exploited, a malicious actor could have replicated and gained read access to Azure PostgreSQL Flexible Server customer databases.”

The experts called the exploit chain ExtraReplica. Microsoft mitigated the vulnerability within 48 hours (on January 13, 2022).

“By exploiting an elevated permissions bug in the Flexible Server authentication process for a replication user, a malicious user could leverage an improperly anchored regular expression to bypass authentication to gain access to other customers’ databases.” reads the advisory published by Microsoft. “All Flexible Server Postgres servers deployed using the public access networking option were impacted with this security vulnerability.”  

Microsoft’s advisory states that the flaws don’t impact customers using the private access networking option.

The two flaws are a PostgreSQL privilege escalation bug and a cross-account authentication bypass using a forged certificate issue.

Below is the step by step attack procedure:

Choose a target PostgreSQL Flexible Server.Retrieve the target’s common name from the Certificate Transparency feed.Purchase a specially crafted certificate from DigiCert or a DigiCert Intermediate Certificate Authority.Find the target’s Azure region by resolving the database domain name and matching it to one of Azure’s public IP ranges.Create an attacker-controlled database in the target’s Azure region.Exploit vulnerability #1 on the attacker-controlled instance to escalate privileges and gain code execution.Scan the subnet for the target instance and exploit vulnerability #2 to gain read access!

Microsoft states that no action is required by customers, it also recommends customers to enable private network access when setting up their Flexible Server instances to mitigate the flaws.

“Please vote for Security Affairs as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections “The Underdogs – Best Personal (non-commercial) Security Blog” and “The Tech Whizz – Best Technical Blog” and others of your choice.
To nominate, please visit: https://docs.google.com/forms/d/e/1FAIpQLSfxxrxICiMZ9QM9iiPuMQIC-IoM-NpQMOsFZnJXrBQRYJGCOw/viewform  

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Azure)