Four-year Azure App Service flaw exposed hundreds of source-code repositories

A security flaw has been disclosed in Microsoft's Azure App Service that exposed the source code of customer applications written in Java, Node, PHP, Python and Ruby for at least four years, starting in September 2017.

Codenamed NotLegit, the vulnerability was reported to the technology giant by Wiz researchers on 7 October 2021, after which mitigation measures were taken in November to fix the information-disclosure bug. Microsoft said a limited subset of customers was at risk, adding that only customers who deployed code to App Service Linux using Local Git after creating files in the application were affected.

Azure App Service, also known as Azure Web Apps, is a cloud-computing platform for building and hosting web applications. It allows users to deploy source code and artifacts using a local Git repository or repositories hosted on GitHub and Bitbucket.

The insecure default behaviour occurs when Local Git is used to deploy to Azure App Service, resulting in the Git repository being created in a publicly accessible directory, home/site/wwwroot.

Although Microsoft adds a web.config file to the .git folder containing repository state and history to restrict public access, these configuration files are used only with C# or ASP.NET applications running on Microsoft's IIS web servers. Applications written in other languages, such as PHP, Ruby, Python or Node, and deployed with other web servers such as Apache, Nginx and Flask, are left out.

"Essentially, all a malicious user had to do was retrieve the /.git directory from the target application and obtain its source code," said Wiz researcher Shir Tamari. "Malicious actors continuously scan the internet for exposed Git folders from which they can collect secrets and intellectual property. Besides the possibility of source code containing secrets such as passwords and access tokens, leaked source code is often used for further sophisticated attacks. Finding software vulnerabilities is much easier when source code is available," Tamari added.