Attributed metadata history
Up to 100 retained publisher events per page for 90f6e0bfcf19954d6be607a981c89edf60f51b4f30c626dcb600ca7b8551c95e. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_d11443da85ea659d49
observed · 2026-10-12 15:37:04 UTC
Multiple Azure Web services use a source control management (SCM) panel powered by Kudu and enabled by default. These services were all susceptible to a CSRF vulnerability due to an overly-permissive regular expression (regex) in a filter for malformed origins. This allowed origin bypass when using a domain name structured as 'victim.scm.azurewebsites.net._.attacker.com' (note the use of '._.', which looks like an emoji). Thus, if a target Azure user were tricked into visiting a specially crafted webpage served by a domain with the above name format, an attacker could exploit this CSRF vulnerability to deploy a zip file containing a malicious payload (such as a webshell) into a target web application (via the /api/zipdeploy endpoint). This could have allowed the attacker to gain remote code execution (RCE) as the 'www' user on the target app, and potentially also lateral movement to other Azure services used by the target organization, depending on what privileges were granted to the app's managed identity.
Fingerprint: 138fa72f7c293b2259ce6c7ddf0104265fef3bd79ac641509b05d4b87f1c708a
intelligence_src_d11443da85ea659d49
observed · 2026-10-12 15:37:03 UTC
available
Fingerprint: 46fd50ac705e064c7517d97d61b5ec511c9b1ada6209622159dd39573ba08e5c