A new vulnerability has been discovered in Microsoft’s Azure Service Fabric Explorer (SFX) that allows unauthenticated, remote attackers to execute code in containers hosted on Service Fabric nodes.
A cross-site scripting (XSS) flaw (CVE-2023-23383), dubbed Super FabriXss by the Orca security team, has a CVSS score of 8.2 and affects SFX versions 9.1.1436.9590 and earlier.
Orca security researcher Lidor Ben Shitrit wrote in an advisory on Thursday:
An iframe (an HTML element designed to embed web content into a website) retrieves a remote file from an attacker-controlled server and executes a malicious PowerShell reverse shell.
“This attack chain could end up executing remote code on containers deployed in the cluster, potentially giving the attacker control over critical systems,” Shitrit added.
The Orca security team has confirmed that it reported the vulnerability to the Microsoft Security Response Center (MSRC) on December 20, 2022. MSRC has investigated the issue and released a fix as part of Patch Tuesday March 2023.
More information on the latest Patch Tuesday can be found here.
According to Shitrit, this is the second XSS vulnerability Orca found in Azure Service Fabric Explorer. However, the first one (called FabriXss) affected both Linux and Windows clusters, whereas the SuperFabriXxs flaw exists only in Windows clusters. Still, Shitrit warned that the new vulnerability is far more dangerous than the previous ones the team discovered.
“Super FabriXss allows unauthenticated, remote attackers to execute code in containers hosted on one of your Service Fabric nodes,” reads the advisory. “An attacker could take control of a critical system and cause significant damage.”
Orca Security has created a proof of concept for the Super FabriXss vulnerability. This is detailed in the team’s technical documentation.
