CSRF Vulnerability in Kudu SCM Allowed Code Execution in Azure Services
SecurityWeek covers the Ermetic discovery of a cross-site request forgery (CSRF) vulnerability impacting the source control management (SCM) service Kudu
A recent article in SecurityWeek covers the Ermetic discovery of a cross-site request forgery (CSRF) vulnerability impacting the source control management (SCM) service Kudu, which could be exploited to achieve remote code execution (RCE) in multiple Azure services.
According to Ionut Arghire, "Successful exploitation of the security defect could allow an attacker to run code as the www user, steal or tamper with sensitive data, launch phishing campaigns, and even move laterally to other Azure services."
