{"id":218148,"date":"2018-11-13T15:19:55","date_gmt":"2018-11-13T14:19:55","guid":{"rendered":"https:\/\/www.intrinsec.com\/?p=218148"},"modified":"2018-11-13T15:19:55","modified_gmt":"2018-11-13T14:19:55","slug":"azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces","status":"publish","type":"post","link":"https:\/\/www.intrinsec.com\/en\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\/","title":{"rendered":"[Azure] Pratique de d\u00e9veloppement non s\u00e9curis\u00e9e : exposition d\u2019identifiants d\u2019acc\u00e8s"},"content":{"rendered":"

[et_pb_section admin_label=\u00a0\u00bbsection\u00a0\u00bb]
\n\t\t\t[et_pb_row admin_label=\u00a0\u00bbrow\u00a0\u00bb]
\n\t\t\t\t[et_pb_column type=\u00a0\u00bb4_4″][et_pb_text admin_label=\u00a0\u00bbText\u00a0\u00bb]\u00c0 l\u2019occasion de r\u00e9cents tests d\u2019intrusion, nous avons identifi\u00e9 une pratique de d\u00e9veloppement exposant des identifiants d\u2019acc\u00e8s \u00e0 la plateforme Microsoft Azure Web Sites<\/em><\/a> \u2013 service permettant de d\u00e9velopper et h\u00e9berger des applications web dans le cloud. Cette pratique peut conduire \u00e0 la compromission du serveur FTP associ\u00e9 et, par voie de cons\u00e9quence, permettre un acc\u00e8s ill\u00e9gitime en lecture et en \u00e9criture au code source, aux fichiers de journalisation et au syst\u00e8me d\u2019exploitation sous-jacent.<\/p>\n

D\u2019apr\u00e8s notre cellule de Cyber Threat Intelligence<\/em><\/a>, plus d\u2019un millier d\u2019identifiants d\u2019acc\u00e8s sont rendus publics sur GitHub<\/em><\/a>, Pastebin<\/em><\/a> et autres services d\u2019h\u00e9bergement de code ou de fichiers.<\/p>\n

Contexte<\/h2>\n

Le service Microsoft Azure Web Sites<\/em> permet de g\u00e9n\u00e9rer et d\u2019exporter un fichier de configuration PublishSettings<\/em> ayant vocation \u00e0 \u00eatre import\u00e9 dans PowerShell ou Visual Studio, pour faciliter l\u2019administration de l\u2019application dans une logique de d\u00e9veloppement continu. Ce fichier , qui permet \u00e0 ces applications d\u2019effectuer des requ\u00eates sur l\u2019API Azure sans s\u2019encombrer de proc\u00e9dures manuelles, est particuli\u00e8rement sensible en cela qu\u2019il contient les identifiants et mots de passe d\u2019acc\u00e8s aux serveurs FTP et de d\u00e9ploiement MSDeploy<\/em>.<\/p>\n

Obtention du fichier<\/h2>\n

Le t\u00e9l\u00e9chargement du fichier en question peut \u00eatre effectu\u00e9 depuis la page de la ressource correspondant \u00e0 l\u2019application Web sur le portail Azure :<\/p>\n

\n

\"\"<\/p>\n

Figure 1 : Obtention du profil de publication<\/p>\n<\/div>\n

 <\/p>\n

Nous obtenons alors un fichier nomm\u00e9 $nomDuSite.PublishSettings<\/em> dans lequel sont renseign\u00e9s des identifiants et mots de passe permettant d\u2019acc\u00e9der au serveur de d\u00e9ploiement MSDeploy<\/em> (en vert) et au serveur FTP (en bleu) :<\/p>\n

\n

\"\"<\/p>\n

Figure 2 : Fichier poc-eval-****.PublishSettings<\/p>\n<\/div>\n

 <\/p>\n

Compromission<\/h2>\n

La pratique que nous \u00e9voquions est la suivante : souvent, le fichier PublishSettings <\/em>est adjoint au code source du projet. Le fichier parvient alors aux diff\u00e9rents intervenants de la cha\u00eene de d\u00e9veloppement (\u00e9quipes de d\u00e9veloppement, auditeurs s\u00e9curit\u00e9, ing\u00e9nieurs qualit\u00e9, etc.). et, dans les cas les plus critiques, il est publi\u00e9 sur des services en ligne tels que GitHub<\/em> ou dans le r\u00e9pertoire du site web (bien qu\u2019Azure<\/em> bloque par d\u00e9faut l\u2019acc\u00e8s \u00e0 ce type de fichiers depuis le navigateur), offrant ainsi la possibilit\u00e9 \u00e0 un attaquant d\u2019y acc\u00e9der et d\u2019utiliser les informations sensibles qui y sont stock\u00e9es.<\/p>\n

Supposons en effet que nous avons obtenu le fichier PublishSettings<\/em> pr\u00e9sent\u00e9 dans la partie pr\u00e9c\u00e9dente. Il nous suffit alors de suivre les liens publishUrl<\/em> et de renseigner les identifiants et mots de passe indiqu\u00e9s.<\/p>\n

Par exemple, nous pouvons nous connecter au serveur FTP et acc\u00e9der au code source :<\/p>\n

\n

\"\"<\/p>\n

Figure 3 : Connexion au serveur FTP<\/p>\n<\/div>\n

 <\/p>\n

Nous pouvons \u00e9galement ajouter ou supprimer des fichiers. Ci-dessous, nous avons supprim\u00e9 index.html<\/em> et ajout\u00e9 poc_ftp.html<\/em> :<\/p>\n

\n

\"\"<\/p>\n

Figure 4 : \u00c9dition du contenu du serveur FTP<\/p>\n<\/div>\n

 <\/p>\n

 <\/p>\n

Notre fichier poc_ftp.html<\/em> est effectivement accessible sur l\u2019application Web :<\/p>\n

\n

\"\"<\/p>\n

Figure 5 : Acc\u00e8s \u00e0 poc_ftp.html<\/p>\n<\/div>\n

 <\/p>\n

Il est notamment possible d\u2019ex\u00e9cuter des commandes syst\u00e8me en d\u00e9posant un webshell<\/em> :<\/p>\n

\n

\"\"<\/p>\n

Figure 6 : Ex\u00e9cution de commandes syst\u00e8me Windows<\/p>\n<\/div>\n

 <\/p>\n

Enfin, nous pouvons acc\u00e9der aux journaux de l\u2019application :<\/p>\n

\n

\"\"<\/p>\n

Figure 7 : Acc\u00e8s aux journaux de l\u2019application<\/p>\n<\/div>\n

 <\/p>\n

 <\/p>\n

Ce fichier de journalisation contient les requ\u00eates effectu\u00e9es aupr\u00e8s du serveur Web. Nous y retrouvons la requ\u00eate GET que nous avons effectu\u00e9e aupr\u00e8s du serveur pour acc\u00e9der au fichier poc_eval.html <\/em>:<\/p>\n

\n

\"\"<\/p>\n

Figure 8 : Journal d\u2019acc\u00e8s du serveur web<\/p>\n<\/div>\n

 <\/p>\n

De nombreux autres fichiers de journalisation sont accessibles sur le serveur FTP : des journaux syst\u00e8me qui contiennent des informations relatives au syst\u00e8me d\u2019exploitation, des journaux applicatifs dans lesquels sont stock\u00e9es les sorties des fonctions de debug<\/em>, ou encore des journaux d\u2019extension indiquant le nom et la version des extensions ajout\u00e9es \u00e0 l\u2019application.<\/p>\n

Recommandations<\/h2>\n

Le contenu de ce fichier \u00e9tant particuli\u00e8rement sensible et non chiffr\u00e9, il convient de porter une attention toute particuli\u00e8re aux permissions qui lui sont appliqu\u00e9es et aux opportunit\u00e9s de lecture par un tiers ill\u00e9gitime.<\/p>\n

Intrinsec recommande les pratiques suivantes :<\/p>\n

    \n
  • Ne pas enregistrer le fichier PublishSettings<\/em> dans le r\u00e9pertoire du projet ;<\/li>\n
  • Supprimer le fichier une fois qu\u2019il a \u00e9t\u00e9 import\u00e9 ;<\/li>\n
  • Mettre en place des tests unitaires dans la cha\u00eene d\u2019int\u00e9gration continue pour v\u00e9rifier l\u2019absence de fichier PublishSettings<\/em> dans les r\u00e9pertoires publi\u00e9s ;<\/li>\n
  • Inclure la v\u00e9rification dans les tests effectu\u00e9s par vos scanners de vuln\u00e9rabilit\u00e9 ;<\/li>\n
  • Envisager un cas d\u2019usage sp\u00e9cifique dans les strat\u00e9gies de d\u00e9tection pour les diff\u00e9rents intervenants de la cha\u00eene de d\u00e9veloppement ;<\/li>\n
  • Mettre en surveillance la fuite ou l\u2019exposition de ce type de documents ;<\/li>\n
  • Communiquer aupr\u00e8s des \u00e9quipes de d\u00e9veloppement sur les bonnes pratiques expos\u00e9es ci-dessus.<\/li>\n<\/ul>\n

     [\/et_pb_text][\/et_pb_column]
    \n\t\t\t[\/et_pb_row]
    \n\t\t[\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"

    [et_pb_section admin_label=\u00a0\u00bbsection\u00a0\u00bb] [et_pb_row admin_label=\u00a0\u00bbrow\u00a0\u00bb] [et_pb_column type=\u00a0\u00bb4_4″][et_pb_text admin_label=\u00a0\u00bbText\u00a0\u00bb]\u00c0 l\u2019occasion de r\u00e9cents tests d\u2019intrusion, nous avons identifi\u00e9 […]<\/p>\n","protected":false},"author":25,"featured_media":218149,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22],"tags":[],"class_list":["post-218148","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-veille-securite"],"yoast_head":"\nIntrinsec - [Azure] Pratique de d\u00e9veloppement non s\u00e9curis\u00e9e : exposition d\u2019identifiants d\u2019acc\u00e8s<\/title>\n<meta name=\"description\" content=\"\u00c0 l\u2019occasion de r\u00e9cents tests d\u2019intrusion, nous avons identifi\u00e9 une pratique de d\u00e9veloppement exposant des identifiants d\u2019acc\u00e8s \u00e0 la plateforme Microsoft Azure Web Sites \u2013 service permettant de d\u00e9velopper et h\u00e9berger des applications web dans le cloud.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.intrinsec.com\/en\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"[Azure] Pratique de d\u00e9veloppement non s\u00e9curis\u00e9e : exposition d\u2019identifiants d\u2019acc\u00e8s\" \/>\n<meta property=\"og:description\" content=\"\u00c0 l\u2019occasion de r\u00e9cents tests d\u2019intrusion, nous avons identifi\u00e9 une pratique de d\u00e9veloppement exposant des identifiants d\u2019acc\u00e8s \u00e0 la plateforme Microsoft Azure Web Sites \u2013 service permettant de d\u00e9velopper et h\u00e9berger des applications web dans le cloud.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.intrinsec.com\/en\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\/\" \/>\n<meta property=\"og:site_name\" content=\"INTRINSEC\" \/>\n<meta property=\"article:published_time\" content=\"2018-11-13T14:19:55+00:00\" \/>\n<meta name=\"author\" content=\"Adrien Bouteiller\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@Intrinsec\" \/>\n<meta name=\"twitter:site\" content=\"@Intrinsec\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Adrien Bouteiller\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\\\/\"},\"author\":{\"name\":\"Adrien Bouteiller\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/person\\\/f66452546f5761d26bb4c6dfa4d9d1e6\"},\"headline\":\"[Azure] Pratique de d\u00e9veloppement non s\u00e9curis\u00e9e : exposition d\u2019identifiants d\u2019acc\u00e8s\",\"datePublished\":\"2018-11-13T14:19:55+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\\\/\"},\"wordCount\":881,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\\\/#primaryimage\"},\"thumbnailUrl\":\"\",\"articleSection\":[\"Veille S\u00e9curit\u00e9\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.intrinsec.com\\\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\\\/\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\\\/\",\"name\":\"Intrinsec - [Azure] Pratique de d\u00e9veloppement non s\u00e9curis\u00e9e : exposition d\u2019identifiants d\u2019acc\u00e8s\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\\\/#primaryimage\"},\"thumbnailUrl\":\"\",\"datePublished\":\"2018-11-13T14:19:55+00:00\",\"description\":\"\u00c0 l\u2019occasion de r\u00e9cents tests d\u2019intrusion, nous avons identifi\u00e9 une pratique de d\u00e9veloppement exposant des identifiants d\u2019acc\u00e8s \u00e0 la plateforme Microsoft Azure Web Sites \u2013 service permettant de d\u00e9velopper et h\u00e9berger des applications web dans le cloud.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.intrinsec.com\\\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\\\/#primaryimage\",\"url\":\"\",\"contentUrl\":\"\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\\\/\\\/www.intrinsec.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"[Azure] Pratique de d\u00e9veloppement non s\u00e9curis\u00e9e : exposition d\u2019identifiants d\u2019acc\u00e8s\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#website\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/\",\"name\":\"INTRINSEC\",\"description\":\"Notre m\u00e9tier , Prot\u00e9ger le v\u00f4tre\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.intrinsec.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#organization\",\"name\":\"INTRINSEC\",\"alternateName\":\"ISEC\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/libellule.png\",\"contentUrl\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/libellule.png\",\"width\":1322,\"height\":1322,\"caption\":\"INTRINSEC\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/Intrinsec\",\"https:\\\/\\\/fr.linkedin.com\\\/company\\\/intrinsec\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UC0trUZAHNZOUbxYnNdecM4A\"],\"description\":\"soci\u00e9t\u00e9 de consulting, pure player cybers\u00e9curit\u00e9 fran\u00e7ais et europ\u00e9en depuis plus de 30ans, sp\u00e9cialiste dans la s\u00e9curit\u00e9 offensive & audit (pentest\\\/red team), GRC, et services IMSS comme le SOC, CTI et CERT Intrinsec est qualifi\u00e9 PASSI Elev\u00e9, PRIS Elev\u00e9 et PACS par l'ANSSI\",\"email\":\"contact@intrinsec.com\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/person\\\/f66452546f5761d26bb4c6dfa4d9d1e6\",\"name\":\"Adrien Bouteiller\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=retro&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=retro&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=retro&r=g\",\"caption\":\"Adrien Bouteiller\"},\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/en\\\/author\\\/adrien-bouteiller\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Intrinsec - [Azure] Pratique de d\u00e9veloppement non s\u00e9curis\u00e9e : exposition d\u2019identifiants d\u2019acc\u00e8s","description":"During recent penetration tests, we identified a development practice exposing access credentials to the Microsoft Azure Web Sites platform \u2013 a service for developing and hosting web applications in the cloud.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.intrinsec.com\/en\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\/","og_locale":"en_US","og_type":"article","og_title":"[Azure] Pratique de d\u00e9veloppement non s\u00e9curis\u00e9e : exposition d\u2019identifiants d\u2019acc\u00e8s","og_description":"\u00c0 l\u2019occasion de r\u00e9cents tests d\u2019intrusion, nous avons identifi\u00e9 une pratique de d\u00e9veloppement exposant des identifiants d\u2019acc\u00e8s \u00e0 la plateforme Microsoft Azure Web Sites \u2013 service permettant de d\u00e9velopper et h\u00e9berger des applications web dans le cloud.","og_url":"https:\/\/www.intrinsec.com\/en\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\/","og_site_name":"INTRINSEC","article_published_time":"2018-11-13T14:19:55+00:00","author":"Adrien Bouteiller","twitter_card":"summary_large_image","twitter_creator":"@Intrinsec","twitter_site":"@Intrinsec","twitter_misc":{"Written by":"Adrien Bouteiller","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.intrinsec.com\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\/#article","isPartOf":{"@id":"https:\/\/www.intrinsec.com\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\/"},"author":{"name":"Adrien Bouteiller","@id":"https:\/\/www.intrinsec.com\/#\/schema\/person\/f66452546f5761d26bb4c6dfa4d9d1e6"},"headline":"[Azure] Pratique de d\u00e9veloppement non s\u00e9curis\u00e9e : exposition d\u2019identifiants d\u2019acc\u00e8s","datePublished":"2018-11-13T14:19:55+00:00","mainEntityOfPage":{"@id":"https:\/\/www.intrinsec.com\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\/"},"wordCount":881,"commentCount":0,"publisher":{"@id":"https:\/\/www.intrinsec.com\/#organization"},"image":{"@id":"https:\/\/www.intrinsec.com\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\/#primaryimage"},"thumbnailUrl":"","articleSection":["Veille S\u00e9curit\u00e9"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.intrinsec.com\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.intrinsec.com\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\/","url":"https:\/\/www.intrinsec.com\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\/","name":"Intrinsec - [Azure] Pratique de d\u00e9veloppement non s\u00e9curis\u00e9e : exposition d\u2019identifiants d\u2019acc\u00e8s","isPartOf":{"@id":"https:\/\/www.intrinsec.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.intrinsec.com\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\/#primaryimage"},"image":{"@id":"https:\/\/www.intrinsec.com\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\/#primaryimage"},"thumbnailUrl":"","datePublished":"2018-11-13T14:19:55+00:00","description":"During recent penetration tests, we identified a development practice exposing access credentials to the Microsoft Azure Web Sites platform \u2013 a service for developing and hosting web applications in the cloud.","breadcrumb":{"@id":"https:\/\/www.intrinsec.com\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.intrinsec.com\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.intrinsec.com\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\/#primaryimage","url":"","contentUrl":""},{"@type":"BreadcrumbList","@id":"https:\/\/www.intrinsec.com\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.intrinsec.com\/"},{"@type":"ListItem","position":2,"name":"[Azure] Pratique de d\u00e9veloppement non s\u00e9curis\u00e9e : exposition d\u2019identifiants d\u2019acc\u00e8s"}]},{"@type":"WebSite","@id":"https:\/\/www.intrinsec.com\/#website","url":"https:\/\/www.intrinsec.com\/","name":"INTRINSEC","description":"Our job is to protect yours.","publisher":{"@id":"https:\/\/www.intrinsec.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.intrinsec.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.intrinsec.com\/#organization","name":"INTRINSEC","alternateName":"ISEC","url":"https:\/\/www.intrinsec.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.intrinsec.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/02\/libellule.png","contentUrl":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/02\/libellule.png","width":1322,"height":1322,"caption":"INTRINSEC"},"image":{"@id":"https:\/\/www.intrinsec.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/Intrinsec","https:\/\/fr.linkedin.com\/company\/intrinsec","https:\/\/www.youtube.com\/channel\/UC0trUZAHNZOUbxYnNdecM4A"],"description":"Intrinsec, a consulting firm and pure-play French and European cybersecurity provider for over 30 years, specializes in offensive security and auditing (penetration testing\/red teams), GRC, and IMSS services such as SOC, CTI, and CERT. Intrinsec is qualified at PASSI High, PRIS High, and PACS levels by ANSSI.","email":"contact@intrinsec.com"},{"@type":"Person","@id":"https:\/\/www.intrinsec.com\/#\/schema\/person\/f66452546f5761d26bb4c6dfa4d9d1e6","name":"Adrien Bouteiller","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=retro&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=retro&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=retro&r=g","caption":"Adrien Bouteiller"},"url":"https:\/\/www.intrinsec.com\/en\/author\/adrien-bouteiller\/"}]}},"_links":{"self":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts\/218148","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/comments?post=218148"}],"version-history":[{"count":0,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts\/218148\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/media?parent=218148"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/categories?post=218148"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/tags?post=218148"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}