Critical · published August 13, 2021
🚨 An incomplete authorization check is a major concern in OneFuzz! This vulnerability allows an authenticated user from any Azure Active Directory tenant to access private data in a vulnerable instance — talk about opening Pandora's box! 🔥 Think of it like a VIP lounge in a club that only checks IDs at the entrance. Once inside, any guest can wander over to the back room where all the secret club plans and sensitive information are stored. If the bouncer doesn’t properly check whose ID is valid for that room, chaos can ensue! An attacker could gain read/write access to a trove of sensitive data, including proprietary code and crash reports. They could tamper with existing records or execute unauthorized code on Azure resources, posing a serious risk to your software and security testing assets. This exploitation could lead to devastating consequences for your organization! ⚡
Think of it like a VIP lounge in a club that only checks IDs at the entrance. Once inside, any guest can wander over to the back room where all the secret club plans and sensitive information are stored. If the bouncer doesn’t properly check whose ID is valid for that room, chaos can ensue! The vulnerability in OneFuzz (versions 2.12.0 to less than 2.31.0) arises from a failure to correctly verify the bearer token's issuer against an administrator-defined allowlist, allowing unintended access to the API by authenticated users from any tenant.
An attacker could gain read/write access to a trove of sensitive data, including proprietary code and crash reports. They could tamper with existing records or execute unauthorized code on Azure resources, posing a serious risk to your software and security testing assets. This exploitation could lead to devastating consequences for your organization! ⚡ Immediately upgrade OneFuzz to version 2.31.0 or later to implement the necessary authorization checks. If you can't upgrade right away, redeploy your OneFuzz instance without the --multi_tenant_domain option to mitigate risk. Don't wait on this! You've got this! Follow these steps and you’ll have your OneFuzz instance securely locked down in no time! 🛡️