Ilan Kalendarov

Improper neutralization of input during web page generation leads to cross-site scripting (XSS), which is a flaw where malicious scripts are injected into trusted websites. An unauthorized attacker can craft a malicious gateway URL that triggers a response-based XSS within the error handling of the software. When visited by a privileged Azure administrator, this allows JavaScript execution under the software origin. This can lead to arbitrary PowerShell execution on every managed server the victim has access to without requiring credentials. In on-premises deployments, this chain enables the theft of Azure access and refresh tokens from local storage, allowing for full tenant impersonation and lateral movement into EntraID and Azure.

An improper access control issue exists in the Azure Portal Windows Admin Center. This allows an authorized attacker to elevate privileges locally.

A security issue exists in Azure Windows Virtual Machine Agent and Azure Arc on Windows that allows an attacker to bypass authentication using an alternate path or channel. Successful exploitation can lead to local privilege escalation, potentially allowing a low-privileged user to gain higher-level access to the system. A compromised machine running Azure Arc can allow an attacker to abuse the Arc identity flow and potentially pivot into the Azure environment.