Access Control: Azure

Accessing an Azure Queue/Blob with a user-controlled value and without proper access control may allow an attacker to view/modify/delete unauthorized Queue/Blob and its messages/contents.

Azure Cloud access control errors occur when:

1. Data enters a program from an untrusted source.


2. The data is used to view/modify/delete unauthorized queue/blob and its messages/contents.
Example 1: The following code deletes the given queue and its messages.

    ...
    var queueName = queryStringData['name'];
    var queueSvc;
    queueSvc = azureStorage.createQueueService();
    ...
    queueSvc.deleteQueue(queueName, option, function(error, response){
      if(!error){
          // all the messages has been deleted
      }
    });
    ...
    

Example 2: The following code deletes the given blob container and its contents.

    ...
    var containerName = queryStringData['name'];
    var blobSvc;
    blobSvc = azureStorage.createBlobService();
    ...
    blobSvc.deleteContainer(containerName, function (error, response) {
      if (!error) {
          // all the content in the given container has been deleted
      }
    });
    ...
    

Although the code in Example 1 and Example 2 delete the given queue/blob container and its messages/contents that belong to the current user/program, an attacker may delete any queue/blob for that Azure account. Because the code in this example does not check to ensure that the user/program has permission to clear the requested queue/blob, it will clear queue/blob, even if it does not belong to the current user/program.