XSS Vulnerabilities Found in Microsoft Azure Cloud Services

Two cloud security vulnerabilities — in Azure Bastion and Azure Container Registry — were found in Microsoft Azure's services, which "allowed an attacker to achieve cross-site scripting (XSS) by using iframe-postMessages [and] allowed unauthorized access to the victim's session within the compromised Azure service iframe," according to Orca Security.

Orca notified the Microsoft Security Response Center (MSRC) immediately upon discovery of the bugs. MSRC was able to reproduce the issues after it was notified of the vulnerabilities' existence in order to patch and verify them.

Cross-site scripting (XSS) is an event in which a threat actor injects malicious scripts into a credible website, ultimately executed by users' browsers unknowingly. At that point, this can lead to severe consequences, noted Orca Security, as threat actors can gain unauthorized access, compromise network systems, or even steal data.

However, "these vulnerabilities require a victim to be lured into visiting a compromised endpoint that the malicious actor controls," commented David Lindner, CISO at Contrast Security, in an emailed statement. "Should Microsoft fix this? Most likely, but I would not call these severe by any means. If anyone gets lured into an attacker-controlled endpoint, all bets are off anyway."

The fixes were automatic, so no further action is required from Azure users, but they may want to look for signs of compromise.