Azure Data Factory & Airflow Flaw Allows Attackers Write Access

Microsoft’s Azure Data Factory integration with Apache Airflow has multiple security vulnerabilities, where attackers can exploit misconfigurations in Kubernetes RBAC and secret handling for the Geneva service to gain unauthorized access to the Airflow cluster. 

It could lead to data exfiltration, malware deployment, and manipulation of critical logs and metrics, highlighting the risks of default, non-changeable configurations and the importance of managing service permissions and monitoring third-party services.

An Azure Data Factory Airflow integration was compromised by a malicious DAG file uploaded to a connected Git repository, which executed a reverse shell, granting attackers access to an Airflow worker pod with elevated Kubernetes cluster admin privileges. 

This allowed them to manipulate DAG files, access secrets, and control the entire cluster, potentially impacting other Azure services like Geneva, as the vulnerability stemmed from default, non-changeable configurations and the assignment of the cluster admin role to the Airflow runner.

An attacker exploited a vulnerability in an Airflow cluster running on Azure Kubernetes Service (AKS) to gain privileged pod access, which allowed them to break out of the container and gain root access to the underlying host VM. 

With this level of control, the attacker could create additional privileged pods, steal sensitive data, and deploy malicious workloads undetected, highlighting the risks associated with running privileged containers and the importance of implementing strong security measures to protect Kubernetes clusters.

By gaining root access on an Azure virtual machine, attackers can leverage Instance Metadata Service (IMDS) and WireServer endpoints to discover managed identities and sensitive information. 

They can then use the retrieved identities and access tokens to enumerate the Azure environment, which includes discovering custom roles, storage accounts, and DNS zones. 

Attackers can acquire a comprehensive understanding of the configuration of the environment and potentially exploit high-privileged roles for further attacks if they analyze these resources and use them to their advantage. 

Researchers analyzed a set of pods named “geneva-services” running in an Azure Kubernetes Service (AKS) cluster, which contained secrets with certificates and private keys used to authenticate with an internal Azure service named Geneva. 

By analyzing the pods’ behavior and reverse engineering a binary related to Geneva, researchers identified internal API endpoints used by Geneva and were able to exploit these endpoints using the stolen credentials to gain access and potentially manipulate various Azure resources like storage accounts and event hubs. 

Unit 42 researchers discovered vulnerabilities in Azure Data Factory’s Apache Airflow integration that allowed unauthorized access to internal data assets. Misconfigured Kubernetes RBAC and Geneva service secrets exposed SAS tokens for data storage and event hubs. 

Weak Geneva authentication further enabled attackers to potentially write arbitrary data to event hubs, manipulate logs, and gain unauthorized administrative control over clusters.

By exploiting these vulnerabilities, attackers could become shadow admins and compromise managed Airflow deployments within a tenant, highlighting the need for comprehensive security strategies beyond basic perimeter defenses, including securing permissions, configurations, and sensitive data assets within the cloud environment. 

Also Read: