Recent Azure updates, especially those for the Azure Command Line Interface (CLI) and Azure Automation, have highlighted greater risks of sensitive data exposure in cloud environments.
These fixes often show that even when the main vulnerability is resolved, ongoing issues such as leaked credentials in logs and poor authentication token handling still pose a widespread risk.
Main Hidden Data Risk Patterns Revealed:
- Credential exposure in CID logs: A serious vulnerability in the Azua CLI revealed that some functions accidentally exposed secrets, including GitHub’s actions logs.
- Token theft in automation pipelines: The Autowarp flaw in Azure Automation demonstrated that attackers could steal managed identity authentication tokens from internal servers, enabling them to fully control other users’ data
- Secret sprawl: studies show that employees often embed credentials directly in code configuration files or Git commits, thereby granting access to internal Azure projects.
- Data drift in AI training: sensitive data such as PII or PHI can end up in AI training sets via partner feeds or logs, potentially leading to leaks via model inversion.
How to Reduce Risks and Best Practices
- Avoid hardcoding secrets: store credentials in Azure Key Vault or use environment variables rather than embedding them in code or configuration files.
- Implement secret planning: use tools such as Azure DevOps credential scanner or GitHub secret scanning to automatically find exposed credentials.
- Secure pipelines: keep Azure CLI updated to version 2.54 or higher to reduce the risk of log exposure.
- Adopt private endpoints: connect virtual networks to Azure services using Azure Private Link. This helps prevent data leaks by avoiding public IP addresses.
Microsoft on Tuesday released patches and guidance to address a high-severity vulnerability in the Azure Command Line Interface (CLI) that could expose sensitive information, such as credentials, through GitHub Actions logs.
Tracked as CVE-2023-36052 and addressed with the release of Azure CLI 2.54 as part of the November 2023 Patch Tuesday, the bug existed because certain Azure CLI functions would inadvertently expose secrets through CI/CD logs.
While many functions echo environment variables to the log, including credentials, and the action is performed as intended, this exposed sensitive information to everyone in public repositories and allowed attackers with read permission on private repositories to retrieve it.
An attacker who successfully exploits this vulnerability could recover plain-text passwords and usernames from log files created by the affected CLI commands and published by Azure DevOps and/or GitHub Actions. Microsoft notes in its advisory.
Aviad Hahami, a security researcher at Palo Alto Networks who reported the bug to Microsoft, examined how the Azure CLI is used in GitHub Actions and identified three main usage patterns.
Hahami notes that some developers were unaware of the issue and did not take any steps to protect themselves, leaving them open to attacks. Others expected Azure CLI to leak sensitive information, so they masked it themselves. Some tried to mask secrets, but still leaked them by creating separate pipelines for create and delete actions.
In guidance on addressing CVE-2023-36052, Microsoft explains that challenge changes were made to several Azure CLI commands and that additional changes will be made to harden Azure CLI against secret exposure.
The tech giant changed multiple products, including Azure Pipelines, GitHub Actions, and Azure CLI, to improve secret redaction, including by adding a new default setting that prevents secrets from leaking in the output of update commands for services in the App Service family.
“Note that this change might adversely impact some automation workflows since certain users might expect secret values in the Azure CLI response to then be used in subsequent parts of the workflow. However, there are safer authoring patterns for automation, and we encourage customers to consider them.” Microsoft notes.
The company also expanded credential redaction capabilities in GitHub Actions and Azure Pipelines to identify more key patterns in logs and mask them.
This reduction is designed to target a specific set of keys for accuracy and performance reasons, and is intended to catch any Microsoft-issued keys that might have inadvertently found their way into public-facing logs, the tech giant says.
Microsoft recommends that all customers follow security best practices for cloud workload development and protection, including keeping Azure CLI updated, not exposing Azure CLI output in logs and publicly accessible locations, rotating keys and secrets regularly, keeping repositories private, and reviewing available guidance on secrets management and the security of GitHub actions and Azure pipelines.
Source: Security Update Guide
