SSRF vulnerabilities in four Microsoft Azure services could be exploited to gain unauthorized access to cloud resources.

Researchers at the security firm Orca discovered that four different Microsoft Azure services were vulnerable to server-side request forgery (SSRF) attacks. Threat actors could have exploited the flaws to gain unauthorized access to cloud resources.

Vulnerable services included Azure API Management, Azure Functions, Azure Machine Learning and Azure Digital Twins.

The researchers successfully exploited two vulnerabilities without requiring any authentication on the Azure Functions and Azure Digital Twins services. The attacks allowed the experts to send requests in the name of the server without even having an Azure account.

“The discovered Azure SSRF vulnerabilities allowed an attacker to scan local ports, find new services, endpoints, and files – providing valuable information on possibly vulnerable servers and services to exploit for initial entry and the location of potential information to target.” reads the analysis published by Orca.

The experts pointed out that SSRF vulnerabilities can allow attackers with access to the host’s IMDS (Cloud Instance Metadata Service), to retrieve detailed info on instances (i.e. hostname, security group, MAC address and user-data) and potentially retrieve tokens, perform lateral movement and execute arbitrary code.

Orca researchers did not manage to reach any IMDS endpoints due to various SSRF mitigations implemented by Microsoft.

Below is the list of flaws discovered by the researchers:

	Affected Service	Severity	Unauthenticated	Date reported	Status
SSRF #1	Azure Digital Twins	Important	Yes	October 8, 2022	Fixed (October 17, 2022)
SSRF #2	Azure Functions App	Important	Yes	November 12, 2022	Fixed (December 9, 2022)
SSRF #3	Azure API Management	Important	No	November 12, 2022	Fixed (November 16, 2022)
SSRF #4	Azure Machine Learning	Low	No	December 2, 2022	Fixed(December 20, 2022)

• SSRF #1 – Unauthenticated SSRF Vulnerability on Azure Digital Twins Explorer allows any unauthenticated user to request any URL by abusing the server.
• SSRF #2 – Unauthenticated SSRF Vulnerability on Azure Functions allows any unauthenticated user to request any URL abusing the server.
• SSRF #3 – Authenticated SSRF Vulnerability on Azure API Management Service allows any authenticated user to request any URL abusing the server.
• SSRF #4 – Authenticated SSRF Vulnerability on Azure Machine Learning Service allows any authenticated user to request any URL abusing the server.

Organizations can mitigate SSRF attacks by validating all input and ensuring that servers are configured to only allow necessary inbound and outbound traffic. The researchers recommend adopting the principle of least privilege (PoLP) and keeping their system up to date and avoiding misconfiguration.

“After flagging the vulnerabilities to Microsoft, they were swiftly mitigated.” concludes the report. “The most notable aspect of these discoveries is arguably the number of SSRF vulnerabilities we were able to find with only minimal effort (including another SSRF vulnerability we found last year in Oracle Cloud Services), indicating just how prevalent they are and the risk they pose in cloud environments.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, Microsoft Azure services)

[adrotate banner=”5″]

[adrotate banner=”13″]

The post Experts found SSRF flaws in four different Microsoft Azure services appeared first on Security Affairs.

When dozens of defense ministers meet at an airbase in Germany on Friday, all eyes will be set on what Berlin is – and is not – willing to provide Ukraine.

Defense leaders from roughly 50 countries and the North Atlantic Treaty Organization will confer at Ramstein Air Base, the latest in a series of meetings since Russia invaded Ukraine nearly 11 months ago.

The focus is expected to be not on what the United States will provide, but on whether Germany will send its Leopard battle tanks to Ukraine or at least approve their transfer from third countries.

“The U.S. is expecting Europeans to take the lead,” said Rachel Rizzo, a fellow at the Atlantic Council. “I would expect the U.S. to be rightly privately pushing the Europeans to dedicate more of their resources.”

Ukraine has relied primarily on Soviet-era T-72 tank variants and the Leopard 2 tank is regarded as one of the West’s best, operated by armies in about 20 countries. The tank weighs more than 60 tons, has a 120mm smoothbore gun and can hit targets at a distance of up to five km.

U.S. Defense Secretary Lloyd Austin had been set to meet German Defense Minister Christine Lambrecht in Berlin before the Ramstein conference, but she resigned from her post on Monday.

Instead, Germany’s new Defense Minister Boris Pistorius will host Austin on Thursday.

The United States has committed roughly $24 billion to help Ukraine defend itself against Russian forces.

U.S. officials, speaking on the condition of anonymity, said President Joe Biden’s administration is next expected to approve Stryker armored vehicles for Kyiv but is not poised to send its own tanks, including the M1 Abrams.

With Republicans taking control of the U.S. House of Representatives in early January, Democrat Biden could be under pressure domestically to ask European allies to do more.

Germany has become one of Ukraine’s top military supporters in response to Russia’s invasion, overcoming a taboo rooted in its bloody 20th century history, but it has not yet agreed to send tanks or allow other countries to send their own German-made tanks.

Some German officials have signaled a softening of their view ahead of the meeting in Ramstein.

Vice Chancellor Robert Habeck, whose Economy Ministry is responsible for approving defense exports, has said that Berlin should not stand in the way of countries that want to send Leopards to Ukraine.

Still, critics say German Chancellor Olaf Scholz and his ruling SPD are too slow, waiting for allies to act first instead of assuming Germany’s responsibility as the Western power closest to Ukraine.

“The ball is in Germany’s court,” a U.S. official said.

Eastern and central European NATO allies rely mainly on the German-built Leopards, which military experts say are the Western tanks best suited to forming the core of a new Ukrainian armored force.

Some Eastern European officials have publicly called on Germany to allow the transfer of Leopard tanks to Ukraine.

Poland’s Prime Minister Mateusz Morawiecki on Monday urged Germany to send Ukraine the weaponry it needed to take the fight to invading Russian soldiers, lacing a speech in Berlin with implicit criticisms of Scholz’s government.

Britain has said that it would send 14 of its main battle tanks along with additional artillery support to Ukraine, a step officials hope will open the door for Germany to make similar moves.

“I know there have been concerns in the German political body that they don’t want to go alone. Well, they’re not alone,” British Defense minister Ben Wallace said on Monday.

Related Galleries:

Eighteen people including Ukraine’s interior minister and other senior officials were killed on Wednesday when a helicopter crashed in a suburb outside Kyiv, the national police chief said. read more

* The national police chief said Interior Minister Denys Monastyrskyi was killed in the helicopter crash. His first deputy, Yevheniy Yenin, and the ministry’s state secretary also died. It was not immediately clear what caused the helicopter to crash.

* More than 9,000 civilians, including 453 children, have been killed since the war began last February, a Ukrainian presidential aide said. The United Nations human rights agency has put the civilian toll at more than 7,000.

* Ukrainian authorities called off the search for survivors in the ruins of an apartment building destroyed during Russian missile attacks on Saturday on the central city of Dnipro. A total of 45 people were confirmed killed.

* The training of Ukrainian officers to operate the Patriot advanced long-range air defence system will last 10 weeks, Ukraine’s Defence Minister Oleksii Reznikov said.

* Russian Foreign Minister Sergei Lavrov accused the United States of preparing the ground for the conflict in Ukraine as part of what he called a hybrid war against Moscow.

* The European Union’s chairman Charles Michel spoke in favour of the West providing tanks to Ukraine to help it fight against Russia’s invasion.

* Russia’s Gazprom said it will ship 32.6 million cubic metres of gas to Europe via Ukraine on Wednesday, a volume in line with recent days but around 20% lower than daily shipments recorded in the final months of last year.

Related Galleries:

Eighteen people including Ukraine’s interior minister, other senior ministry officials and three children were killed on Wednesday morning when a helicopter crashed near a nursery outside Kyiv, Ukrainian officials said.

The regional governor said 29 people were also hurt, including 15 children, when the helicopter came down in a residential area in Brovary, on the capital’s northeastern outskirts.

Several dead bodies draped in foil blankets lay in a courtyard near the damaged nursery. Emergency workers were at the scene. Debris was scattered over a playground.

National police chief Ihor Klymenko said Interior Minister Denys Monastyrskyi had been killed alongside his first deputy, Yevheniy Yenin, and other officials in a helicopter belonging to the state emergency service.

“There were children and…staff in the nursery at the time of this tragedy,” Kyiv region governor Oleksiy Kuleba wrote on Telegram.

Officials did not give an immediate explanation of the cause of the helicopter crash. There was no immediate comment from Russia, whose troops invaded Ukraine last February, and Ukrainian officials made no reference to any Russian attack in the area at the time.

Monastyrskyi, responsible for the police and security inside Ukraine, would be the most senior Ukrainian official to die since the war began.

Separately, Ukraine reported intense fighting overnight in the east of the country, where both sides have taken huge losses for little gain in intense trench warfare over the last two months.

Ukrainian forces repelled attacks in the eastern city of Bakhmut and the village of Klishchiivka just south of it, the Ukrainian military said. Russia has focused on Bakhmut in recent weeks, claiming last week to have taken the mining town of Soledar on its northern outskirts.

After major Ukrainian gains in the second half of 2022, the frontlines have hardened over the last two months. Kyiv says it hopes new Western weapons would allow it to resume an offensive to recapture land, especially heavy tanks which would give its troops mobility and protection to push through Russian lines.

Western allies will be gathering on Friday at a U.S. air base in Germany to pledge more weapons for Ukraine. Attention is focused in particular on Germany, which has veto power over any decision to send its Leopard tanks, which are fielded by armies across Europe and widely seen as the most suitable for Ukraine.

Berlin says a decision on the tanks will be the first item on the agenda of Boris Pistorius, its new defence minister.

Britain, which broke the Western taboo on sending main battle tanks over the weekend by promising a squadron of its Challengers, has called on Germany to approve the Leopards. Poland and Finland have already said they would be ready to send Leopards if Berlin allows it.

Related Galleries:

Republican Rep. George Santos of New York in the House Chamber on January 4, 2023.

OLIVIER DOULIERY/AFP via Getty Images

• A military veteran has accused George Santos of taking money from his sick dog’s GoFundMe.
• Rich Osthoff says he spoke to one Anthony Devolder — a known alias of Santos’ — about fundraising.
• Santos has denied knowing Osthoff.

A military veteran is accusing the scandal-ridden Rep. George Santos of taking $3,000 worth of GoFundMe funds meant for his dying dog.

Rich Osthoff, who lives in New Jersey, spoke to the media outlet Patch about a conversation he had with a man named Anthony Devolder in 2016. Devolder is one of Santos’ known aliases.

Osthoff told the media outlet his dog Sapphire was dying from a stomach tumor and that Devolder offered to help, starting a GoFundMe page for Sapphire in May 2016. But after the GoFundMe raised $3,000, Osthoff says Devolder closed the fundraising page and started ghosting him.

Osthoff said that during one phone conversation, Devolder told him the money raised from Sapphire’s GoFundMe would be going to “other dogs,” per Patch. Devolder eventually stopped answering Osthoff’s texts and calls, Osthoff said.

The New York Times reported on December 19 that Santos claimed to have founded a charity called Friends of Pets United from 2013 to 2018. But the Times found no record of Friends of Pets United ever having been registered as a charity.

Insider saw multiple posts on Osthoff’s Facebook page from May to July 2016 that linked out to a GoFundMe page titled, “Click here to support sapphire The Veteran rescue! by Anthony Devolder.” The page has been deleted, and the Internet archive Wayback Machine does not have a record of the fundraiser.

Osthoff said Sapphire died in January 2017 and that he could not afford to cremate her. “I had to panhandle. It was one of the most degrading things I ever had to do,” Osthoff told Patch.

Santos has denied knowing Osthoff.

“Fake,” Santos told Semafor via text message. “No clue who this is.”

Santos has admitted to lying about various elements of his past, including going to university, being Jewish, and working at Goldman Sachs and Citigroup. However, the congressman has refused to resign, saying he will only do so if as many people demand his resignation as voted for him.

Osthoff and representatives for GoFundMe and Santos did not immediately respond to Insider’s requests for comment.

Qatari Foreign Minister, Sheikh Mohammed bin Abdulrahman Al-Thani said Europe’s energy security is ultimately its own decisions.

Chris J Ratcliff/AFP/Getty Images

• Qatar’s energy minister said Europe would be able to “forgive and forget” Russia for the Ukraine war.
• He was weighing in on the natural-gas supply and demand dynamics at an energy forum on Saturday.
• But Qatar walked that back quickly, saying that was not the country’s official position.

Qatar’s found itself caught in a foreign relations pickle this week after the country’s energy minister said Europe could eventually “forgive and forget” Russia’s invasion of Ukraine.

“I understand that the Europeans today are saying there is no way we’re going back to Russian gas. We’re all blessed to have to be able to forget and to forgive. And I think things get mended with time,” Saad Sherida al-Kaabi, Qatar’s energy minister, said during an energy forum in Abu Dhabi on Saturday, according to an official transcript. 

Al-Kaabi was weighing in on how supply and demand for natural gas can come to a balance in the future.

“The equilibrium will be achieved by hopefully some kind of a mediation or truce or some kind of a political solution where Russia and Europe get things, I think, sorted out, if you will, politically hopefully, and the sooner the better,” he said at the Atlantic Council Global Energy Forum. “I don’t think that — this war and this situation will not last forever.”

Russian natural-gas exports to Europe have fallen sharply after the Kremlin cut gas flows, citing challenges related to sweeping sanctions over its invasion of Ukraine.

Historically, Europe’s depended on Russia for 40% of its natural-gas needs. But the continent is now working to improve its energy security by weaning itself off Russian gas. Russia’s been scrambling to replace its major customer, and as pivoted to selling its natural gas to other markets such as China and India.

Al-Kaabi weighed in on the alternate trade flows as well, saying “Russian gas is going to come back, in my view, to Europe. It is next year? Is it in five years? I don’t know. But once the situation is sorted out.”

However, Mohammed bin Abdulrahman Al Thani, Qatar’s foreign minister, appeared to backpedal on his colleague’s statements on Tuesday, saying that was “not actually” the official position of the country. He was speaking to CNBC’s Hadley Gamble on whether al-Kaabi’s comment was Qatar’s official. 

“Well, it’s not actually. First of all, politically speaking, when we are talking about the situation and the war, Qatar has a very clear political stance on this: we don’t accept the invasion of another country,” Al Thani told CNBC.

“We don’t accept threatening by force or the use of force, we don’t accept civilians to be hurt. And we have been demonstrating this throughout our votes within the United Nations,” Al Thani added, according to the network.

Qatar supported a UN General Assembly resolution in March 2022 that demanded Russia’s withdrawal from Ukraine.

Al Thani said Europe’s energy security is ultimately the continent’s own decisions.

“At the end of the day, from our perspective and our policy, as state of Qatar, we never politicize the energy. We see that food, medicine, energy, those are items that need to be protected, because they are for the people, they are not for the government, or for political reasons,” he told CNBC.

Qatar’s energy and foreign ministries did not immediately respond to Insider’s requests for comment.