Critical Azure Vulnerabilities: Misconfigured Roles & VPN Key Leak

Security researchers discovered multiple misconfigured Azure built-in roles granting excessive permissions. Coupled with a vulnerability in the Azure API allowing VPN key leaks, this creates an attack chain enabling a low-privileged user to access internal cloud assets and on-premises networks. The research details the discovery process, implications, and mitigation strategies. Ten built-in roles were found to be over-privileged, while the VPN key leak vulnerability has been patched by Microsoft. Recommendations include auditing problematic roles, using limited scopes, and creating custom roles with fine-grained permissions.