Security Experts:

Connect with us

Hi, what are you looking for?


Application Security

Microsoft Warns of Information Leak Flaw in Azure Container Instances

Microsoft has patched an Azure Container Instances (ACI) vulnerability that could have allowed users to access the information of other Azure customers.

Microsoft has patched an Azure Container Instances (ACI) vulnerability that could have allowed users to access the information of other Azure customers.

The company did not provide technical details on the vulnerability but security researchers with Palo Alto Networks say attackers could have exploited the  bug to execute code on other users’ containers, steal sensitive information such as crypto secrets, and even deploy crypto-mining malware.

Microsoft said it it notified customers that might have been affected, through the Service Health Notifications in the Azure Portal. Those that did not receive a notification need take no action, the company added.

“There is no indication any customer data was accessed due to this vulnerability. Out of an abundance of caution, notifications were sent to customers potentially affected by the researcher activities, advising they revoke any privileged credentials that were deployed to the platform before August 31, 2021,” Microsoft said in a statement.

All Azure customers are encouraged to rotate privileged credentials on a frequent basis, as a precautionary measure.

The issue, which is being called Azurescape, could lead to the compromise of the Kubernetes clusters hosting ACI, thus providing attackers with full control over other Azure customers’ containers, according to Palo Alto Network researchers.

While built to prevent attacks from malicious neighbor containers – cross-account or cross-tenant attacks – ACI was found to use an older runC (standard container runtime) version that was vulnerable to multiple container escape flaws.

[ READ: Critical Vulnerability Exposed Azure Cosmos DBs for Months ]

Using a modified version of the proof-of-concept code exploiting one of those bugs — CVE-2019-5736 — the researchers were able to break out of a container and gain a root reverse shell on the underlying host. Next, they found token permissions in the kube-system namespace that allowed them to execute commands on any pod in the cluster, which they used to perform the cross-account attack.

“A malicious Azure user could have compromised the multitenant Kubernetes clusters hosting ACI. As cluster administrator, an attacker could execute commands in other customer containers, exfiltrate secrets and private images deployed to the platform, or deploy cryptominers. A sophisticated adversary would further investigate the detection mechanisms protecting ACI to try to avoid getting caught,” Palo Alto said.

Released in July 2017, ACI is a Container-as-a-Service (CaaS) built on multitenant clusters (Kubernetes and, more recently, Service Fabric Clusters), which supports deployment of containers while eliminating the need to manage the underlying infrastructure.

Two weeks ago, Microsoft addressed a similar issue in Azure Cosmos DB, where users could access other customer’s databases with full administrative rights, potentially taking full control of them.

Related: Critical Vulnerability Exposed Azure Cosmos DBs for Months

Related: Microsoft Office Zero-Day Hit in Targeted Attacks

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.


The North Korean APT tracked as TA444 is either moonlighting from its previous primary purpose, expanding its attack repertoire, or is being impersonated by...

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.


The FBI dismantled the network of the prolific Hive ransomware gang and seized infrastructure in Los Angeles that was used for the operation.

Identity & Access

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the...


The Hive ransomware website has been seized as part of an operation that involved law enforcement in 10 countries.


Out of the 335 public recommendations on a comprehensive cybersecurity strategy made since 2010, 190 were not implemented by federal agencies as of December...