Cloud-Wide Contamination: Chaining SSRFs for Tenant Compromise in Azure (CVE-2025-29972)
summary
Finds an SSRF in Azure Storage Resource Provider that lets an attacker host a metadata URL, force ARM/SRP to request it, and leak an Azure AD token; combines that token with a DNS rebinding timing trick (15s probes against a 5‑minute DNS cache) to make SRP call other SRP instances and execute actions like regenerate SFTP password for another tenant; PoC returns SSH password in cleartext logs and achieves storage account impact; assigned CVE-2025-29972 with 9.8 CVSS; author demonstrates Gandalf domain and spray-and-pray for bind and reports mitigations and fixes.
AI-written summary · about
chapters (27)
- 0:00Research introduction
- 1:07Azure vulnerability research
- 2:30SSRF vulnerability CVE-2025-29972
- 3:53Session roadmap and SSRF discovery
- 4:36Storage Resource Provider logic
- 6:23SSRF primitive deep dive
- 8:30Triggering SSRF via encryption scope
- 10:21Bypassing security flags
- 11:26Azure AD token leakage
- 13:32Attack infrastructure setup
- 15:23SSRF to token theft flow
- 16:30Impact of leaked Azure AD tokens
- 18:12Cross-service attack vectors
- 20:39DNS rebinding bypass
- 21:43DNS binding challenges
- 24:17Spray and pray attack
- 26:04Demo: spray and pray
- 27:07SSRF targeting internal services
- 28:11Attacking Storage Resource Provider
- 29:36SFTP password reset across tenants
- 31:42Demo: cross-tenant SFTP reset
- 32:48Full attack chain and persistence
- 34:14SSH password exposure takeover
- 36:42Why Azure wasn't fully compromised
- 37:25Azure security layers and mitigations
- 38:50Post-disclosure mitigations
- 39:10Key takeaways
related talks
52mUncovering Azure's Silent Threats: A Journey Into Cloud Vulnerabilities
41mUncovering Azure's Silent Threats: A Journey into Cloud Vulnerabilities
40mBreaking Managed Data Services in the Cloud
58mPrivilege Escalation in Microsoft Azure
48mTackling the Recent Rise of Cross-Tenant Vulnerabilities
55mAzure Attacks Unpacked: Real-World Threats & Lessons
55mOffensive Azure Security
38mAbusing Azure Active Directory: From MFA Bypass to Listing Global Administrators