InfoSecBulletin Cybersecurity for mankind
A critical vulnerability in Microsoft Azure’s API Connection allowed attackers to breach resources in various Azure tenants globally. Gulbrandsrud discovered the flaw that earned him a $40,000 bounty and a chance to present at Black Hat. This flaw exploited Azure’s shared API Management setup, allowing unauthorized access to Key Vaults, Azure SQL databases, and third-party services like Jira and Salesforce.
The vulnerability involved Azure’s shared APIM instance, where all API Connections are hosted, leading to security risks that go beyond tenant boundaries.
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
Azure’s Default API Connection Vulnerability:
The vulnerability was found in how Azure Resource Manager (ARM) handled the DynamicInvoke endpoint, which processes API Connection requests using highly privileged tokens.
When ARM receives a DynamicInvoke request, it constructs URLs using the pattern /apim/[ConnectorType]/[ConnectionId]/[Action-Endpoint] with elevated authentication tokens.
Gulbrandsrud found that attackers could exploit a custom Logic App connector with a weak path parameter to perform path traversal attacks.
The researcher demonstrated this by defining a simple endpoint with a {path} parameter, then supplying malicious input like ../../../../[VictimConnectorType]/[VictimConnectionID]/[action].
When ARM processed this request, URL normalization resulted in direct access to victim connections.
The attack was demonstrated against an Azure Key Vault connection:
Mitigation:
Microsoft acknowledged the vulnerability within three days of the April 7, 2025 disclosure and applied fixes within a week. The first fix was to create a blacklist for path parameters to block ../ sequences and their URL-encoded versions.
Gulbrandsrud mentioned that this solution might not be enough, and suggested alternatives like path normalization techniques or altering the API connection paths.
The vulnerability required Contributor-level privileges to the attacking tenant’s API Connection, limiting the attack surface to privileged users.
SafeLine: A Free Zero Trust Web Application Firewall for 2026
