Wiz Details ExtraReplica Flaw Chain Enabling Cross-Tenant Access to Azure PostgreSQL

Summary

Wiz found an Azure PostgreSQL Flexible Server flaw chain enabling cross-tenant database replication via privilege escalation and certificate-authentication bypass. Microsoft patched it; public-access servers were affected, while VNet-private servers were not.

Key points

Wiz researchers chained two flaws to replicate databases across Azure PostgreSQL Flexible Server customer accounts.
A flaw in Azure’s modified PostgreSQL engine allowed privilege escalation to superuser and OS-level code execution; Microsoft patched it, and Wiz withheld exploitation details.
Instances could reach other PostgreSQL servers over an internal subnet, even when the target’s firewall denied connections.
A permissive certificate Common Name regular expression allowed researchers to authenticate as a target server’s replication user using a specially crafted certificate.
Researchers identified target server identifiers through SSL certificates or the public Certificate Transparency feed, then used an instance in the target’s Azure region to access the database.
The cross-account bypass affected Flexible Server instances configured for public access, regardless of firewall rules; it did not affect Private access (VNet) instances or PostgreSQL Single Server.
Microsoft said the issue was fully mitigated, it knew of no exploitation attempts, and customers did not need to take action. A fix was rolled out by February 25, 2022.

Article Details

Attack Vectors: Exploited a bug in Azure's modified PostgreSQL engine to escalate privileges on an attacker-controlled Flexible Server instance and execute operating-system-level commands.
Used network access from the PostgreSQL container to scan the internal subnet and reach other customer PostgreSQL instances, including instances whose firewall denied connection attempts.
Exploited an overly permissive certificate Common Name regular expression to authenticate as the replication user using a specially crafted client certificate.
Obtained target database identifiers from SSL certificates or the public Certificate Transparency feed, then used them to craft certificates and replicate database contents.
Defensive Notes: Microsoft reported that the vulnerabilities were fixed and fully mitigated; it said customers did not need to take action and that it was not aware of exploitation attempts.
The cross-account authentication bypass did not affect Flexible Server instances configured with Private access (VNet Integration), according to Microsoft.
Microsoft did not disclose how many customers or databases were vulnerable.
Wiz recommends that organizations request cloud-provider documentation describing the isolation architecture of services they use.