The Cloud is a Spider Web: But with Broken Threads

The Cloud is a Spider Web: But with Broken Threads

Speakers: Nitesh Surana, Sr. Threat Researcher, Trend Micro; Nelson William Gamazo Sanchez, Staff Threat Researcher, Trend Micro

Conference: fwd:cloudsec Europe 2025

YouTube: https://www.youtube.com/watch?v=-hA0B8nvY5I

Overview

Nitesh Surana and Nelson William Gamazo Sanchez, cloud threat researchers at Trend Micro, presented a sweeping investigation into two classes of cloud security vulnerabilities: overly permissive cloud credentials embedded in URL parameters (specifically Azure SAS tokens) and universal cloud DNS zone takeovers — the dangling resource problem applied to cloud service domains. The research resulted in approximately 8,000 subdomain takeover reports to Microsoft across 10+ Azure services, the discovery of supply chain attack chains involving a signed DLL with embedded storage account keys, and six concrete cases where universal DNS zone takeovers led to immediate or near-immediate remote code execution. The findings span CMS providers, Autodesk Revit plugins, Azure CLI installation via Winget, PowerShell Gallery, Microsoft ML libraries, and Jenkins controllers — demonstrating that this class of vulnerability is pervasive and uniquely dangerous in cloud environments.

Background

▶ Watch: SAS token history — from Azure Functions tampering to the Wiz 38TB Microsoft ... (2:00)

Azure SAS tokens (Shared Access Signatures) are URL parameters that delegate access to Azure Storage resources. They can specify permissions (read, write, delete, list, create), expiry dates, and scope (individual blob, container, or entire storage account). SAS token misconfigurations have a documented history: in 2019, Azure Functions code could be tampered via the storage account SAS token, and Wiz researchers reported a SAS token that exposed 38 terabytes of Microsoft AI researcher data.

Universal cloud DNS zones are shared DNS namespaces used by cloud services — for example, .blob.core.windows.net for Azure Storage or .azurewebsites.net for Azure App Service. When a customer creates a cloud resource, they claim a name in these shared zones. When they delete the resource, the name becomes available to anyone. If other code, documentation, or infrastructure still references the deleted resource's domain name, an attacker can re-register it, creating a supply chain attack opportunity. Microsoft documents 27 universal DNS zones for Azure's global namespace, with an additional 27 for the China namespace. Determining which of these are prone to takeover requires active research, as Microsoft does not publish this information.

The security mindset for universal DNS zones inverts the normal best practice: in private DNS, deleting unused records is good hygiene; in universal cloud DNS zones, deleting records creates security debt, because the freed names become available for attacker registration.

Key Findings

▶ Watch: Signed DLL containing storage account access keys for Axis Communications plugin (6:30)

SAS Tokens in the Wild

Scanning the Common Crawl collection from Q1 2025, the researchers found a roughly equal split between read-only and read-write SAS tokens in public-facing websites, with non-Azure domains using SAS tokens almost universally having write permissions. Scanning the top one million websites revealed a SAS token with read, write, list, and create permissions expiring in February 2030, used across eight websites. The token lacked subresource integrity (SRI) checks on the script tags referencing the JavaScript files it served. By identifying a custom footer shared across these websites, the researchers traced the token back to a CMS provider using the same SAS token — meaning modification of a single JavaScript file would propagate malicious code to all the CMS provider's customers in a classic supply chain attack.

Signed DLL with Embedded Storage Account Keys

Hunting on VirusTotal for SAS URLs in binary files, the researchers discovered a signed DLL from AEC AB (an Autodesk partner for building information modeling) that contained not just SAS tokens but full storage account access keys for two Azure Storage accounts. These accounts stored MSI packages and product-related files for the Axis Plugin for Autodesk Revit, used by customers of Axis Communications (the Swedish company that invented the network camera in 1996).

The vulnerability went through three disclosure iterations. In version 7.0.8, two storage accounts with SAS tokens and access keys were exposed. Version 7.1.0 "fixed" the issue by obfuscating the credentials — easily defeated by de4dot deobfuscation — and introduced a new storage account with fresh access keys. Version 7.1.8 (the correct fix) contained only read-and-list SAS tokens with no storage account keys, though a previously unrevoked key still provided access via the old plugin binary. The full chain was devastating: an attacker could modify RFA files (Autodesk Revit compound documents) stored in the writable storage account, and researchers from Trend Micro's Zero Day Initiative (ZDI) demonstrated that crafted RFA files could achieve remote code execution through vulnerabilities in Autodesk Revit's file parsing.

Universal DNS Zone Takeovers at Scale

Scanning Common Crawl for Azure universal DNS zone domains, the researchers identified millions of unique URLs with potential takeover candidates across multiple Azure services. The check name availability API allowed validation of which storage accounts could actually be re-registered. Six specific takeover cases were presented, five of which resulted in direct remote code execution without requiring additional vulnerability research:

1. Azure Storage account serving documents to Microsoft internal networks — Traffic from Microsoft's own netblocks was observed accessing documents. RCE required exploiting a document format vulnerability (the only non-direct RCE case).

1. Team Foundation Server 2017 custom Python package repository — A Dockerfile referenced a custom Python package index on a takeable domain. Taking over the domain allowed serving malicious packages, and since this was connected to TFS, the attacker could potentially exfiltrate the entire source code repository.

1. Azure Service Bus library Jenkins controller — A Jenkins build automation script in a public library accessed a Jenkins controller on a takeable domain. Taking over the domain provided access to the Jenkins CLI and potentially all CI/CD pipeline credentials and secrets.

1. PowerShell Gallery recommending takeable endpoints — Microsoft documentation referenced endpoints on takeable domains for PowerShell Gallery, allowing supply of malicious PowerShell modules.

1. Microsoft ML forecasting library (2019) — Notebooks and scripts referenced blob storage for Python wheel files on a takeable domain. Though the library was abandoned (last updated 2019), the domains only became available for takeover recently, and the notebooks remained in circulation via forks.

1. Azure CLI installation via Winget — The Azure CLI package metadata referenced a takeable domain for selecting MSI installers by platform. Taking over this domain allowed replacement of the entire Azure CLI binary during Winget-based installation. Post-takeover monitoring revealed that CI/CD pipelines continued requesting old CLI versions from the taken-over domain even after Microsoft fixed the issue, indicating widespread use of pinned, outdated package references in automated workflows. The domain had been available since a CDN decommission by Microsoft around April–May 2024.

Technical Deep Dive

▶ Watch: Universal DNS zones: deleting cloud resources creates security debt, not hygiene (14:00)

The SAS token supply chain attack through the CMS provider demonstrates how a single overly permissive credential propagates risk through a dependency chain. The SAS token (with read, write, list, create permissions, expiring 2030) was embedded in JavaScript tags without subresource integrity hashes. Modifying the hosted JavaScript file would affect every website using the CMS, enabling credential theft, session hijacking, or browser-based cryptomining across all downstream customers.

The Axis Communications full chain is particularly instructive. The RFA file format is an OLE compound document (a structured binary format containing streams of data). ZDI researchers identified multiple vulnerabilities in Autodesk Revit's RFA parsing that could be exploited for remote code execution. The attack chain: attacker obtains write access to the Azure Storage account via credentials in the DLL, replaces legitimate RFA files with malicious ones, and when an Axis customer loads a product into their Autodesk Revit environment via the plugin's product selector, the malicious RFA triggers code execution on the endpoint.

The DNS zone takeover validation using the check name availability API is critical because DNS lookups alone are insufficient to confirm takeover potential. A domain that does not resolve may still be registered (e.g., the DNS record was removed but the storage account still exists in another form). The API check confirms whether the specific resource name can actually be re-registered.

The Azure CLI Winget takeover case reveals a deeper systemic issue. Microsoft decommissioned a CDN in 2014, duplicating the service, which freed up the domain. The Azure CLI metadata still referenced the old domain. Even after Microsoft's fix, CI/CD pipelines using pinned old versions of Azure CLI continued making requests to the taken-over domain, demonstrating how build pipeline technical debt extends the window of vulnerability far beyond the initial fix.

Demo / Proof of Concept

▶ Watch: Azure Service Bus Jenkins controller takeover — access to entire CI/CD pipeline (18:00)

The researchers demonstrated the Axis Communications full chain: opening Autodesk Revit with the Axis plugin installed, creating a new project, navigating to the product selector ribbon, selecting a product to load, and receiving a shell — all through a proxied malicious RFA file served from the compromised storage account. They also demonstrated monitoring traffic on taken-over domains, showing requests from CI/CD pipelines for old Azure CLI versions continuing after Microsoft's fix.

Defensive Implications

▶ Watch: 8,000 takeover reports to Microsoft — vendor response and remediation actions (24:00)

Organizations should take the following defensive actions:

• Scan all releases (binaries, container images, APKs) for embedded cloud credentials including SAS tokens and storage account keys. Static scanning tools should be part of the release pipeline.
• Implement subresource integrity (SRI) checks on all externally hosted JavaScript files to prevent supply chain modification attacks.
• Apply the principle of least privilege to SAS tokens — never grant write permissions when read suffices, and use the shortest feasible expiration dates.
• Maintain a credential rotation plan and ensure that credential revocation is verified end-to-end, including checking that old binaries with embedded credentials are no longer accessible.
• Proactively monitor for universal DNS zone takeovers by inventorying all cloud resource domains referenced in code, documentation, CI/CD pipelines, and package metadata, and verifying they are still actively registered.
• Treat internal infrastructure changes as externally visible — decommissioning a CDN, deprecating a service, or archiving a repository can free up domain names that are still referenced by external code and CI/CD pipelines.
• Pin and regularly update dependencies in CI/CD pipelines to avoid continued use of deprecated or vulnerable package references.
• Sandbox and QA-test all third-party software before distribution, especially plugins that interact with cloud storage.

Key Takeaways

• Azure SAS tokens with write permissions and distant expiry dates remain pervasive in public-facing websites, CMS platforms, and even signed DLLs — creating supply chain attack opportunities.
• Universal cloud DNS zone takeovers affect 27+ Azure DNS zones and can result in immediate remote code execution through supply chain compromise.
• Approximately 8,000 takeover-vulnerable resources were reported to Microsoft across 10+ Azure services, with Microsoft responding through repository archival, active sinkholing, and documentation changes.
• The Azure CLI Winget installation chain was vulnerable to complete binary replacement via DNS zone takeover, with CI/CD pipelines continuing to request old versions even after the fix.
• Internal changes (CDN decommission, service deprecation) create external security debt when domain names become available for re-registration.
• Credential obfuscation in binaries is not a fix — motivated threat actors trivially deobfuscate with tools like de4dot.

About the Speaker(s)

Nitesh Surana is a Senior Cloud Threat Researcher at Trend Micro, recognized in the top 10 MSRC researchers for 2024 for his work on Microsoft Azure. He specializes in cloud security vulnerability research with a focus on Azure storage, identity, and supply chain attack surfaces. Nelson William Gamazo Sanchez is a Staff Threat Researcher at Trend Micro with experience in computer security since 2000, spanning anti-malware, computer forensics, and cloud security threat research. The RFA exploitation was conducted in collaboration with Trend Micro's Zero Day Initiative (ZDI).