Technology
Researcher reports five Azure API Connections flaws enabling cross-tenant access
A security researcher describes five critical elevation-of-privilege vulnerabilities in Azure API Connections that allegedly allowed attackers to access or modify services connected to other tenants, including Key Vault and SQL databases. The report attributes the findings to flaws in path handling, undocumented endpoints and runtime URL validation. The researcher says Microsoft fixed the reported issues after disclosure, though some remediations initially left alternate attack paths. The claims come from the researcher’s technical investigation, not an independent Microsoft confirmation.
Editorial summary · Publisher article
What matters
- The reported attack paths could reach connected services using another tenant’s configured credentials.
- The researcher says early path restrictions did not address the underlying token-handling problem.
- Undocumented DynamicList and related endpoints reportedly exposed additional routes after an initial fix.
- A later validation fix allegedly failed because checking occurred before path normalization.
- The researcher says all five vulnerabilities were eventually fixed within a reasonable period.
What the reported flaws exposed
The researcher says Azure API Connections used shared management and API-management components in ways that could let an attacker redirect calls from an owned connection toward another tenant’s backend. The claimed impact included reading secrets and issuing database operations, although practical exposure depended partly on how customers scoped their connected credentials.
Disclosure and remediation
After Microsoft blocked some endpoints and added path checks, the researcher says alternate functions and Logic Apps’ runtime URL handling created further attack paths. A later fix reportedly required the runtime URL to match the referenced connection exactly, but another normalization issue briefly reopened an earlier route. The researcher says Microsoft ultimately addressed all five findings.
Context & caveats
- The article is a researcher’s account; Microsoft’s independent assessment, affected-customer scope and deployment status are not included.
Why this made the edition
The long technical account describes multiple cross-tenant Azure vulnerabilities, exploitation mechanisms, disclosure history and Microsoft’s reported fixes, with attribution and caveats.
Source material