● Covered by 1 source · 1 reportHigh impact1 negative
Azure API Connections Vulnerabilities Lead to Five Cross-Tenant Compromises
Key points
- Five new vulnerabilities found in Azure API Connections.
- Flaws allow full cross-tenant compromise of connected backend services.
- Affected services include Key Vaults, Azure SQL, Jira, and Salesforce.
- Exploitation relies on tricking API Management to use victim's connection token.
New Vulnerabilities Discovered
New vulnerabilities have been identified within Azure API Connections, a part of Azure Logic Apps. These discoveries follow previous reports on insecure architecture within the same system. The researcher reported five distinct instances of full cross-tenant compromise resulting from these flaws.
Impact of Cross-Tenant Compromise
The identified vulnerabilities allow an attacker to fully compromise any other connection worldwide, granting complete access to the associated backend services. This includes sensitive Azure services such as Key Vaults and Azure SQL databases, as well as external services like Jira or Salesforce. The core issue is the ability to bypass input validation layers and trick the API Management instance into operating on a victim's connection.
API Connection Architecture Overview
Azure API Connections function by having a logic app query a shared Azure API Management instance. This instance validates the connector type, exchanges an input token for a configured token for the backend service, and then completes the call to the backend. The critical vulnerability arises if an attacker can manipulate the API Management instance to use a victim's configured token for their backend service.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
Multiple vulnerabilities in Azure API Connections, a component of Azure Logic Apps, allowed for five distinct cross-tenant compromises. These flaws enabled attackers to gain full access to connected backend services, including Azure Key Vaults and SQL databases, across different tenants.