{"uuid": "2bec17d0-1c84-49ff-b258-3c5592f1c8d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-29972", "type": "seen", "source": "https://t.me/hacking_Attack/52851", "content": "Black Hat Ethical Hacking\nMicrosoft releases fixes for Azure flaw allowing RCE attacks\n\nMicrosoft releases fixes for Azure flaw allowing RCE attacksPost Views: 1 \nPremium Content\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/patreon-300x61.png https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-2.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nMicrosoft has released security updates to address a security flaw affecting Azure Synapse and Azure Data Factory pipelines that could let attackers execute remote commands across Integration Runtime infrastructure.\nThe Integration Runtime (IR)\u00a0compute infrastructure is used by Azure Synapse and Azure Data Factory pipelines to provide data integration capabilities across network environments (e.g., data flow, activity dispatch, SQL Server Integration Services (SSIS) package execution).\n\nThe vulnerability (tracked as CVE-2022-29972 and dubbed SynLapse by\u00a0Orca Security\u00a0Tzah Pahima) was mitigated on April 15, with no evidence of exploitation before fixes were released.\n\nAccording to Pahima\u2019s findings, attackers can exploit this bug to access and control other customers\u2019 Synapse workspaces, allowing them to\u00a0leak sensitive data including Azure\u2019s service keys, API tokens, and passwords to other services.\nI was able to access #Azure user credentials and run code on other customers\u2019 machines.\nThe vulnerability is called #SynLapse.\n\nIt was a vulnerability in Azure Synapse Analytics (@Azure_Synapse) & Azure Data Factory, exploiting a major flaw in the tenant separation.\n\n(1/3)\n\n\u2014 Tzah Pahima (@TzahPahima) May 9, 2022\nSee Also: Complete Offensive Security and Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png \u201cThe vulnerability was found in the third-party ODBC data connector used to connect to Amazon Redshift, in Integration Runtime (IR) in Azure Synapse Pipelines, and Azure Data Factory,\u201d Microsoft explained\u00a0in a security advisory published today.\n\n\u201cThe vulnerability could have allowed an attacker to perform remote command execution across IR infrastructure not limited to a single tenant,\u201d the company added in a Microsoft Security Response Center (MSRC) blog post.\n\nSuccessful exploitation of this ODBC connector for Amazon Redshift flaw could let malicious attackers running jobs in a Synapse pipeline execute remote commands. \n\nIn the next attack stage, they could potentially steal the Azure Data Factory service certificate to execute commands in another tenant\u2019s Azure Data Factory Integration Runtimes.\n\n\u201cBased on our understanding of the architecture of the service, and our repeated bypasses of fixes, we think that the architecture contains underlying weaknesses that should be addressed with a more robust tenant separation mechanism,\u201d Orca Security\u2019s Avi Shua said.\n\n\u201cUntil a better solution is implemented,\u00a0we advise that all customers assess their usage of the service and refrain from storing sensitive data or keys in it.\u201d\nSee Also: Attackers Use Event Logs to Hide Fileless Malware How to mitigateMicrosoft says that customers using Azure cloud (Azure Integration Runtime) or who host their own on-premises (Self-Hosted Integration Runtime) with auto-updates turned on don\u2019t need to take any further action to mitigate this flaw.\n\nSelf-host IR customers who don\u2019t have auto-update toggled on were already notified to safeguard their deployments via Azure Service Health Alerts (ID: MLC3-LD0). \n\nThe company advises them to update their self-hosted IRs to the latest version (5.17.8154.2) available on Microsoft\u2019s Download Center.\n\nThese updates can be installed on 64-bit systems with .NET Framework 4.7.2 or above running client and server platforms, including [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:41.886783Z"}