InfoSecBulletin Cybersecurity for mankind
A critical vulnerability in Microsoft Azure’s API Connection allowed attackers to breach resources in various Azure tenants globally. Gulbrandsrud discovered the flaw that earned him a $40,000 bounty and a chance to present at Black Hat. This flaw exploited Azure’s shared API Management setup, allowing unauthorized access to Key Vaults, Azure SQL databases, and third-party services like Jira and Salesforce.
The vulnerability involved Azure’s shared APIM instance, where all API Connections are hosted, leading to security risks that go beyond tenant boundaries.
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
FortiSandbox, FortiOS, FortiProxy ZTNA flaws unveil, while Fortigate firewall actively exploited
Azure’s Default API Connection Vulnerability:
The vulnerability was found in how Azure Resource Manager (ARM) handled the DynamicInvoke endpoint, which processes API Connection requests using highly privileged tokens.
When ARM receives a DynamicInvoke request, it constructs URLs using the pattern /apim/[ConnectorType]/[ConnectionId]/[Action-Endpoint] with elevated authentication tokens.
Gulbrandsrud found that attackers could exploit a custom Logic App connector with a weak path parameter to perform path traversal attacks.
The researcher demonstrated this by defining a simple endpoint with a {path} parameter, then supplying malicious input like ../../../../[VictimConnectorType]/[VictimConnectionID]/[action].
When ARM processed this request, URL normalization resulted in direct access to victim connections.
The attack was demonstrated against an Azure Key Vault connection:
Mitigation:
Microsoft acknowledged the vulnerability within three days of the April 7, 2025 disclosure and applied fixes within a week. The first fix was to create a blacklist for path parameters to block ../ sequences and their URL-encoded versions.
Gulbrandsrud mentioned that this solution might not be enough, and suggested alternatives like path normalization techniques or altering the API connection paths.
The vulnerability required Contributor-level privileges to the attacking tenant’s API Connection, limiting the attack surface to privileged users.
SafeLine: A Free Zero Trust Web Application Firewall for 2026
