Microsoft Fixes Azure Automation Service Flaw

Microsoft has fixed the AutoWarp vulnerability in Azure Automation service.

Microsoft fixed the problem by blocking access to auth tokens for all sandboxes except those that had legitimate access.

Microsoft confirmed that there is no evidence that AutoWarp was exploited in attacks or that Managed Identities tokens with managed identities were misused.

Microsoft has notified all affected customers of the Azure Automation service and recommended that best security practices be followed.

The vulnerability allows an attacker to steal other Azure customers’ data including the Managed Identities authentication tokens. This is stolen from an internal server that manages the sandboxes of other users.

The vulnerability was discovered by Orca Security’s Cloud Security Researcher Yanir Tsarimi.

According to Tsarimi, affected Azure Automation accounts include those with the Managed Identity feature is enabled by default.

“Automation accounts that use an Automation Hybrid worker for execution and/or Automation Run-Accounts for access to resources were not impacted,” Microsoft said.

IT World Canada Staff
IT World Canada Staff
The online resource for Canadian Information Technology professionals.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

ITW in your inbox

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

More Best of The Web