Vulnerabilities in Azure Data Factory Open Door to Attacks

Security researchers say now-resolved vulnerabilities in a Microsoft Azure integration with the Apache Airflow workflow management platform showcase growing sophistication of attackers.

See Also: Easing Data Recovery in Multi-Cloud Architectures

Researchers from Palo Alto Networks’ Unit 42 said attacks could have allowed attackers to establish “persistent access as shadow administrators over the entire Airflow Azure Kubernetes Service (AKS) cluster.”

Azure Data Factory is a service designed to manage data pipelines that enables data transfer between various sources. Open source Apache Airflow handles the scheduling and coordination of complex workflows.

Microsoft rated the vulnerabilities in Azure Data Factory’s Apache Airflow integration as low severity, but the Unit 42 researchers said the flaws could allow hackers to deploy malware and steal data.

The vulnerabilities stem from issues in Kubernetes role-based access control within the Airflow cluster, where permissions were improperly configured.

Researchers identified a security issue stemming from how Apache Airflow instances in Azure Data Factory were configured. Airflow’s default settings, which could not be modified, were linked to a powerful “cluster admin” role assigned to the Airflow runner. This configuration meant that anyone exploiting the system could leverage the cluster admin role to gain full control over the Airflow cluster and any associated infrastructure. The rigid and overly permissive default setup created a critical vulnerability that attackers could manipulate to escalate privileges and compromise the environment.

Unit 42 researchers said if attackers gained access to the Azure Kubernetes cluster hosting Airflow, they could exploit their access to manipulate Geneva – a critical Azure service that manages logs and metrics. This could allow attackers to alter log data – covering their tracks – or access sensitive Azure resources, further compromising the cloud environment.

Researchers also spotted flaws in Azure’s internal Geneva service, responsible for managing critical logs and metrics. Weak authentication mechanisms protecting Geneva compounded the risk, making it easier for attackers to bypass security controls and exploit the system. These combined flaws could allow attackers to escalate privileges, compromise sensitive information and gain administrative control over affected cloud environments.

The vulnerabilities are evidence that perimeter defenses are not sufficient, Unit 42 wrote. Defenders should secure permissions and configurations and have a good understanding of which sensitive data assets interact with which cloud services. “Adversaries have moved beyond basic tactics to more sophisticated service-specific attacks,” it wrote.

Unit 42 disclosed the vulnerabilities to Microsoft, and the Microsoft Security Response Center addressed them.