Recently, a security flaw found in the Azure App Service, a Microsoft-managed platform for building and hosting web apps, led to the exposure of PHP, Node, Python, Ruby, or Java customer source code.
- A security flaw found in the Azure App Service has been causing serious problems.This led to the exposure of PHP, Node, Python, Ruby, or Java customer source code.People may still be exposed and should take immediate actions to protect their apps.Microsoft sealed with the flaw by updating PHP images to disallow certain actions.
What’s even more worrying than that, is that this has been happening for at least four years, since 2017.
Azure App Service Linux customers were also impacted by this issue, while IIS-based applications deployed by Azure App Service Windows customers were not affected.
Security researchers warned Microsoft about dangerous flaw
Security researchers from Wiz stated that small groups of customers are still potentially exposed and should take certain user actions to protect their applications.
Details about this process can be found in several email alerts Microsoft issued between the 7th – 15th of December, 2021.
The researchers tested their theory that the insecure default behavior in Azure App Service Linux was likely exploited in the wild by deploying their own vulnerable app.
And, after only four days, they saw the first attempts made by threat actors to access the contents of the exposed source code folder.
Even though this could point to attackers already knowing of the NotLegit flaw and trying to find exposed Azure App Service apps’ source code, these scans could also be explained as normal scans for exposed .git folders.
Malicious third parties have gained access to files belonging to high-profile organizations after finding public .git folders, so it’s not really a question of if, it’s more of a when question.
The affected Azure App Service applications include all PHP, Node, Python, Ruby, and Java apps coded to serve static content if deployed using Local Git on a clean default application in Azure App Service starting with 2013.
Or, if deployed in Azure App Service since 2013 using any Git source, after a file was created or modified in the app container.
Microsoft acknowledged the information, and the Azure App Service team, along with MSRC have already applied a fix designed to cover most impacted customers and alerted all customers still exposed after enabling in-place deployment or uploading the .git folder to the content directory.
The Redmond-based tech giant mitigated the flaw by updating PHP images to disallow serving the .git folder as static content.
Small groups of customers are still potentially exposed and should take certain user actions to protect their applications, as detailed in several email alerts Microsoft issued between the 7th – 15th of December, 2021.
The Azure App Service documentation was also updated with a new section on properly securing apps’ source code and in-place deployments.
If you want to know more about the NotLegit security flaw, a disclosure timeline can be found in Microsoft’s blog post.
What is your take on this whole situation? Share your opinion with us in the comments section below.
If the advices above haven’t solved your issue, your PC may experience deeper Windows problems. We recommend downloading this PC Repair tool (rated Great on TrustPilot.com) to easily address them. After installation, simply click the Start Scan button and then press on Repair All.
Still having issues? Fix them with this tool:
SPONSORED
- Microsoft Azure
Email *
Commenting as . Not you?
Comment
