Cross-Tenant Instance Takeover in Azure Machine Learning Compute
Overview
Security researchers discovered a critical-severity vulnerability in the Azure Machine Learning platform that allowed for a full cross-tenant compute instance takeover. The flaw stemmed from a combination of misconfigurations in the platform's internal network infrastructure. An attacker could provision a compute instance in their own Azure tenant and, by exploiting an internal server-side request forgery (SSRF) vulnerability, gain access to the internal metadata service. This service improperly disclosed network information about other customers' compute instances running on the same shared host. The attacker could then leverage a DNS rebinding attack against a misconfigured internal DNS server to impersonate a legitimate service and intercept traffic intended for a victim's instance. This traffic included an authentication token that granted root access to the victim's compute instance via an internal management service. A successful exploit would grant the attacker full root privileges on another customer's machine learning workspace, allowing them to steal sensitive data and models, access proprietary code, and use the compromised resources for further attacks. The vulnerability exposed a critical failure in multi-tenant isolation within a major cloud AI service.
Affected Systems
Testing Guide
This vulnerability could only be exploited from within Azure's internal infrastructure and cannot be safely or ethically tested by customers. Verification that the environment is no longer vulnerable relies on confirmation and security advisories from the cloud provider (Microsoft).
Mitigation Steps
1. **Cloud Provider Patching:** The primary mitigation was performed by Microsoft on the backend. No customer action was required to fix the root cause. 2. **Use Virtual Network (VNet) Injection:** Customers can enhance security by deploying Azure ML compute instances within a private Virtual Network, which provides an additional layer of network isolation. 3. **Principle of Least Privilege:** Ensure that identities and service principals associated with compute instances have the minimum necessary permissions to access data and other resources. 4. **Monitor for Anomalous Activity:** Regularly monitor compute instance logs for unusual network traffic or unauthorized access patterns.
Patch Details
Microsoft patched the vulnerability on the server-side by correcting internal firewall rules, securing the internal DNS resolver against rebinding attacks, and adding stricter validation to the internal management service. The patch was deployed globally with no impact on customers.