Microsoft Azure bug left a bunch of cloud databases wide open
Microsoft has rolled out a patch to rectify the issue
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Multiple critical vulnerabilities in Azure Database for PostgreSQL Flexible Server were recently discovered and fixed,Microsofthas announced in a security advisory.
As reported byBleepingComputer, the vulnerabilities could have allowed malicious users to escalate privileges and access customerdatabases. Luckily, the exploit was not used to attack Azure customers before the fix was issued, and no data was taken, Microsoft confirmed.
Given that thepatchwas deployed more than a month ago, Azure customers need to take no additional steps to protect their endpoints.
Share your thoughts on Cybersecurity and get a free copy of the Hacker’s Manual 2022. Help us find how businesses are preparing for the post-Covid world and the implications of these activities on their cybersecurity plans. Enter your email at theend of this surveyto get the bookazine, worth $10.99/£10.99.
Fixes deployed
With Flexible Server, Azure Database for PostgreSQL users have more control over their databases. However, in this case, Flexible Server had created an opening for attack.
“By exploiting an elevated permissions bug in the Flexible Server authentication process for a replication user, a malicious user could leverage an improperly anchored regular expression to bypass authentication to gain access to other customers’ databases,” Microsoft said.
“This was mitigated within 48 hours (on January 13, 2022). Customers using the private access networking option were not exposed to this vulnerability. The Single Server offering of Postgres was not impacted.”
By the end of February, all fixes were deployed, Microsoft went on to explain.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Still, the company said it would be wise to deploy PostgreSQL flexibleserverson Azure virtual networks (VNet), as they provide private and secure network communication.
“In order to further minimize exposure, we recommend that customers enable private network access when setting up their Flexible Server instances,” the company said.
Wiz Research, the cloud security company that first discovered the bug, dubbed it ExtraReplica, and added that there were some challenges to keeping track of cloud vulnerabilities.
“As with other cloud vulnerabilities, this issue did not receive a CVE identifier (unlike software vulnerabilities). It is not recorded or documented in any database,” it said. “The absence of such a database impairs the ability of customers to monitor, track, and respond to cloud vulnerabilities.”
ViaBleepingComputer
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
New fanless cooling technology enhances energy efficiency for AI workloads by achieving a 90% reduction in cooling power consumption
Samsung plans record-breaking 400-layer NAND chip that could be key to breaking 200TB barrier for ultra large capacity AI hyperscaler SSDs
NYT Strands today — hints, answers and spangram for Sunday, November 10 (game #252)
