Microsoft has fixed the AutoWarp vulnerability in Azure Automation service.
Microsoft fixed the problem by blocking access to auth tokens for all sandboxes except those that had legitimate access.
Microsoft confirmed that there is no evidence that AutoWarp was exploited in attacks or that Managed Identities tokens with managed identities were misused.
Microsoft has notified all affected customers of the Azure Automation service and recommended that best security practices be followed.
The vulnerability allows an attacker to steal other Azure customers’ data including the Managed Identities authentication tokens. This is stolen from an internal server that manages the sandboxes of other users.
The vulnerability was discovered by Orca Security’s Cloud Security Researcher Yanir Tsarimi.
According to Tsarimi, affected Azure Automation accounts include those with the Managed Identity feature is enabled by default.
“Automation accounts that use an Automation Hybrid worker for execution and/or Automation Run-Accounts for access to resources were not impacted,” Microsoft said.