Critical CSPM Vulnerability Spotted: What You Need to Know

BLUF: A critical "confused deputy" vulnerability in Microsoft Defender for Cloud allowed attackers to exfiltrate tenant data by exploiting weak IAM trust validation during cross-tenant scans 0:05.

Key Takeaways:
• The flaw stemmed from insufficient validation of the IAM role session name, allowing an attacker to trick the vendor into scanning a victim's AWS account by reusing the trust relationship after it was severed 1:15.
• Microsoft mitigated the issue by implementing a mandatory check for the role session name, ensuring scans are only accepted if they originate from the specific tenant that established the connection 3:45.
• The discovery highlights broader risks in cloud integrations, emphasizing the need for strict least-privilege IAM policies and the mandatory cleanup of trust relationships when vendors are disconnected 4:10.

This case study underscores the critical importance of validating identity contexts in cloud integrations and the value of responsible disclosure in securing the cloud ecosystem.

Sources:

• 0:05 Introduction to the vulnerability and its discovery by the authors.
• 1:15 Explanation of the "confused deputy" problem and trust relationship exploitation.
• 3:45 Details on the mitigation involving role session name validation.
• 4:10 Broader implications for cloud vendor integration security.