Synopsis
An information disclosure issue exists in the Azure Arc Jumpstart environment. The script used to provision clients in this environment logs service principal credentials, database credentials, and other potentially sensitive information in plaintext to a log file that is readable by any user on the system.
These logs can be found in the following directory in a default deployment: "C:\Packages\Plugins\Microsoft.Compute.CustomScriptExtension\1.10.12\Status\"
This allows a malicious actor to view potentially sensitive information if they were to gain access to one of these clients in any capacity. They could also potentially elevate privileges to those of the disclosed accounts. Additionally, further lateral compromise of a customer's infrastructure is possible if the disclosed service principals or other credentials are used elsewhere in the customer's environment.
Solution
Users with existing deployments should rotate service principal credentials used in their Arc Jumpstart environment. New deployments require no action from end users.
Microsoft has updated their documentation to warn against re-using the service principals or other accounts created within this environment elsewhere in a customer's Azure environment.
Disclosure Timeline
All information within TRA advisories is provided “as is”, without warranty of any kind, including the implied warranties of merchantability and fitness for a particular purpose, and with no guarantee of completeness, accuracy, or timeliness. Individuals and organizations are responsible for assessing the impact of any actual or potential security vulnerability.
Tenable takes product security very seriously. If you believe you have found a vulnerability in one of our products, we ask that you please work with us to quickly resolve it in order to protect customers. Tenable believes in responding quickly to such reports, maintaining communication with researchers, and providing a solution in short order.
For more details on submitting vulnerability information, please see our Vulnerability Reporting Guidelines page.
If you have questions or corrections about this advisory, please email [email protected]
Contact our sales team