{"id":51235,"date":"2023-03-29T00:00:00","date_gmt":"2023-03-29T00:00:00","guid":{"rendered":"urn:uuid:c7577a22-b4e1-1557-d751-f5ed69c2d8b1"},"modified":"2023-03-29T00:00:00","modified_gmt":"2023-03-29T00:00:00","slug":"azure-serverless-security-risks-exposed-by-new-study","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/azure-serverless-security-risks-exposed-by-new-study\/","title":{"rendered":"Azure Serverless Security Risks Exposed by New Study"},"content":{"rendered":"

<\/p>\n

<\/div>\n
\n

Serverless architectures are increasingly popular, as the cloud provider does most of the heavy lifting, allowing developers to focus on building and running their apps. But this popularity has attracted the scrutiny of threat actors.<\/p>\n

Although serverless environments have a relatively reduced attack surface, with certain responsibilities shifted to the cloud provider (CSP), users must be careful not to introduce extra risk. This could happen if they write insecure code, misconfigure assets or fail to properly secure endpoints.<\/p>\n

Through exploitation simulations of user-provided code vulnerabilities, we evaluated infected serverless environments on Microsoft Azure. In the process, we identified sensitive environmental variables inside the Microsoft Azure environment, leaving opportunities for malicious actors.<\/p>\n

We found two critical issues:<\/p>\n

1. Some crucial secrets for Azure serverless environments are stored inside \u201cenvironment variables.\u201d These variables are present in every process and inherited by default, significantly increasing the chance of exposure. Just one exploited vulnerability in one process could lead to a full compromise of the serverless environment.<\/p>\n

2. If Azure customers use a master key for SSH access, it will allow attackers to escalate privileges inside a container with a known password. Users must deploy public key cryptography for authentication to SSH to stay secure.<\/p>\n

Azure users should remember that they are responsible for implementing security best practices and policies to supplement Microsoft\u2019s default security measures. Application code is particularly important as it could serve as an entry point for attackers if not properly secured, the report revealed.<\/p>\n

We recommended the following for Azure serverless users:<\/p>\n