Exploring Potential Security Challenges in Microsoft Azure

Application and user permissions

Our investigation revealed that in Linux environments, the application and user permissions within an App Service application are running with root privileges within the security boundary of the container. However, the container root user is mapped to a less-privileged user inside the Docker host using the user namespace remap feature, which effectively lowers malicious actors’ attack options upon compromise.

Figure 4. User permission within the App Service environment where the container is running code written in Python

A low-privileged user, such as "www-data", can be used to run an App Service application. "Www-data" is the default user that web servers on Ubuntu and Apache use, and it is also what we used as a PHP container image in our analysis.

Despite being a low-privileged user, "www-data" can still be run under root within the security boundary of the running container when privileges are escalated.

Figure 5. Screenshot of a custom container tutorial from Azure

Source: Microsoft

Malicious actors can perform privilege escalation by entering the hard-coded master password “Docker!” via WebSSH, as it cannot be generated as an asymmetric keypair upon first execution.

Figure 6. Example of privilege escalation on a container running within the App Service application

It’s important to note that the root user does not have all the capabilities of the host machine, and it is limited within container isolation schemes. This means that the container is not running in privileged mode.

Network

In our research paper, we list down the available root user capabilities within containers implemented on Linux. One of these root user capabilities is CAP_NET_RAW, which allows the creation of raw sockets. Raw sockets give access to lower layer protocols and can be abused in low-level network attacks.

A running container exposes two ports: a publicly accessible port for incoming connections that are handled by the application itself, and a port hidden behind the Azure authentication gateway for remote secure shell (SSH) access that only authenticated Azure App Service users can initiate.

Outbound network connections are enabled by default, which initiate remote connections to internet-available servers. These connections can be abused by attackers to initiate reverse shell connection attacks.

By default, a local area network (LAN) consists of a minimum of three IP addresses

 • An IP address for the container network interface itself
 • An IP address that serves as the default gateway for accessing the internet
 • An IP address for incoming SSH connections from WebSSH

Figure 7. Default network scheme

Source: Trend Micro Security News

Disk Access

Source code is deployed inside the "/tmp/{build directory}" folder when a container is executed and CI/CD is configured. Because containers are mainly designed to be stateless, there is an interesting Server Message Block 3.0 (SMB3) network mount on the "/home" directory. This volume serves as a persistent storage that hosts website files when CI/CD is not configured.

Historically, SMB servers are known for having multiple vulnerabilities. The WannaCry ransomware, one of the most nefarious ransomware families in history, previously abused an SMB vulnerability in its attack.