A soon-to-be-released Black Hat USA talk warns that Azure API Connections left connected apps vulnerable to data leaks by low-privileged or unauthenticated users until Microsoft patched the flaw earlier this year. 

Binary Security’s Haakon Gulbrandsrud found that Azure API Connections could let read-only users breach sensitive systems such as Jira, Slack, databases, and key vaults, as many applications grant overly broad access and rely too heavily on Azure’s ARM to enforce restrictions. 

Because Azure delegates authentication and subsequent operations to ARM and its tokens, any weakness in ARM’s logic poses a significant security risk, warns Gulbrandsrud. 

"Whenever Azure makes a request to a back-end resource, it owns it, and you have to trust that Azure does the [security] checking correctly," he says. "I wouldn't say that the security model is bolted on, because it's quite clear from the start that this is how Azure [works] ... and that works fine until you start copying back-end APIs into your platform." 

The threat landscape in cloud computing is growing. Cisco warned in June that ISE instances deployed on AWS, Azure, or Oracle Cloud Infrastructure all share identical credentials per platform. In April, Varonis discovered that attackers could bypass MFA using two Azure Entra ID authentication cookies. Back in February, watchTowr reported that abandoned cloud storage might be used to launch supply chain attacks by mimicking old library sources. 

Lapses in Azure Security Expose Critical Gaps 

Gulbrandsrud uncovered that Azure users with only reader privileges could exploit API Connections to access sensitive data. Although ARM limits readers to GET requests, some connected APIs ignore these restrictions, allowing unauthorized users broader access — including full control of authentication mechanisms. 

Essentially, "if you ever wanted to post something to Salesforce in the Logic app, then suddenly every low privileged user in your tenant can read everything in your Salesforce," he says.

Another problem is that the creation of API connections is not explicit, but performed in the background whenever a user sets up an action attached to a Logic App. "Even if you have never heard of them before, it is quite possible that there are a lot of them hanging out in your tenant," Gulbrandsrud stated in a blog post on the original issue. 

During a client project, Gulbrandsrud identified a critical issue where Logic Apps in Azure, when connected to Slack, revealed sensitive data that could potentially be used to exploit other platforms like Jira. 

"Now, naively, I would think that this means that some user, probably whoever set this up, is authenticated to this connection, and we would need his token to call through the connection, or maybe do an OAuth dance ourselves," he stated in the March analysis of his findings. "What I would not expect is that anyone with reader permissions on the connection is allowed to arbitrarily call any endpoint on the connection."