The Unit 42 Threat Intelligence team has identified the first known vulnerability that could enable one user of a public cloud service to break out of their environment and execute code on environments belonging to other users in the same public cloud service.

According to the Palo Alto Networks Unit 42 Threat Intelligence team, this unprecedented cross-account takeover affected Microsoft’s Azure Container-as-a-Service (CaaS) platform. Researchers named the finding Azurescape because the attack started from a container escape – a technique that enables privilege escalation out of container environments.

Azurescape allows an ACI user to gain administrative privileges over an entire cluster of containers. From there, the user could take over the impacted multitenant clusters to execute malicious code, steal data or sabotage the underlying infrastructure of other customers. The attacker could gain complete control over Azure’s servers that host containers of other customers, accessing all data and secrets stored in those environments.

The main issue here involves the service provider failing to run the latest version of runC - a lightweight, universal container runtime and a command-line tool for spawning and running containers, explains Josh Angell, Managing Consultant at nVisium.

Angell says, “The vulnerability in runC allows a user to override the runC binary, thus allowing the user to gain root-level code execution on the host. Why is this significant? Because that host is a multitenant cluster, it allowed the attacker to gain control over the other users in that cluster.”

Since it’s a two-year-old vulnerability with a patch, Angell calls this a lesson learned in the importance of updating services and libraries to ensure they’re running the latest versions with all of the security patches in those services.

“Security teams must ensure they update their services and libraries — which was done quickly once this issue became known,” Angell says. “It is a well-known tactic that attackers most often identify older versions of services and libraries to research vulnerabilities within those outdated services, making it easier to gain a foothold into the system. You leave yourself wide open to situations like these by keeping vulnerable components exposed — you’re essentially providing adversaries an instruction manual titled, ‘How to Break My System.’”

Microsoft took swift action to fix the underlying issues as soon as we reported them to the Microsoft Security Response Center (MSRC).

Though the Unit 42 Threat Intelligence team is not aware of any Azurescape attacks in the wild, it is possible that a malicious user of the Azure Container Instances (ACI) platform could have exploited the vulnerability to execute code on other customers’ containers without any prior access to their environment. 

The Unit 42 Threat Intelligence Team says the vulnerability highlights the need for cloud users and organizations to take a “defense-in-depth” approach to secure their cloud infrastructure that includes monitoring for threats both inside and outside the cloud platform. Azurecape also underscores the need for cloud service providers to provide adequate access for outside researchers to study their environments, searching for unknown threats, researchers say.

Douglas Murray, CEO at Valtix, says, “There’s no doubt that the public cloud is an incredible enabler of business agility and net positive for organizations making the cloud transition. However, Azurescape and other such platform service vulnerabilities continue to highlight that the already difficult task of security is different in the cloud. Zero-day vulnerabilities will continue to occur, and the shared responsibility model often complicates remediation.

“In the end, the lesson learned is that same lesson we’ve known for many years – defense-in-depth is essential. While many tools can help, the network is still common ground – every app touches it. Organizations need to secure ingress, egress, and east-west network traffic to/from/between their cloud apps. Organizations must ensure that every application and cloud service has the necessary security controls to prevent data exfiltration or detect other malicious activity through network threat prevention.”