{"id":218148,"date":"2018-11-13T15:19:55","date_gmt":"2018-11-13T14:19:55","guid":{"rendered":"https:\/\/www.intrinsec.com\/?p=218148"},"modified":"2018-11-13T15:19:55","modified_gmt":"2018-11-13T14:19:55","slug":"azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces","status":"publish","type":"post","link":"https:\/\/www.intrinsec.com\/en\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\/","title":{"rendered":"[Azure] Insecure development practice: exposing access credentials"},"content":{"rendered":"<p>[et_pb_section admin_label=\u00bbsection\u00bb]<br \/>\n\t\t\t[et_pb_row admin_label=\u00bbrow\u00bb]<br \/>\n\t\t\t\t[et_pb_column type=&quot;4_4&quot;][et_pb_text admin_label=&quot;Text&quot;]During recent penetration tests, we identified a development practice that exposes platform access credentials <a href=\"https:\/\/azure.microsoft.com\/\"><em>Microsoft Azure Web Sites<\/em><\/a> \u2013 a service that allows the development and hosting of web applications in the cloud. This practice can lead to the compromise of the associated FTP server and, consequently, allow illegitimate read and write access to the source code, log files, and underlying operating system.<\/p>\n<p>According to our cell of <a href=\"https:\/\/www.intrinsec.com\/en\/cyber-threat-intelligence\/\"><em>Cyber Threat Intelligence<\/em><\/a>, more than a thousand access credentials are made public on <a href=\"https:\/\/github.com\/\"><em>GitHub<\/em><\/a>, <a href=\"https:\/\/pastebin.com\/\"><em>Pastebin<\/em><\/a> and other code or file hosting services.<\/p>\n<h2>Context<\/h2>\n<p>The service <em>Microsoft Azure Web Sites<\/em> allows you to generate and export a configuration file <em>PublishSettings<\/em> This file, designed to be imported into PowerShell or Visual Studio to facilitate application administration within a continuous development framework, allows these applications to query the Azure API without manual procedures. It is particularly sensitive because it contains the usernames and passwords for accessing the FTP and deployment servers. <em>MSDeploy<\/em>.<\/p>\n<h2>Obtaining the file<\/h2>\n<p>The file in question can be downloaded from the resource page corresponding to the web application on the Azure portal:<\/p>\n<div id=\"attachment_4038\" class=\"wp-caption alignnone\">\n<p><img fetchpriority=\"high\" decoding=\"async\" class=\"wp-image-4038 size-full\" src=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/05\/publishsettings_1.png\" sizes=\"(max-width: 947px) 100vw, 947px\" srcset=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/05\/publishsettings_1.png 947w, https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/05\/publishsettings_1-300x104.png 300w, https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/05\/publishsettings_1-768x265.png 768w\" alt=\"\" width=\"947\" height=\"327\"><\/p>\n<p class=\"wp-caption-text\">Figure 1: Obtaining the publication profile<\/p>\n<\/div>\n<p>&nbsp;<\/p>\n<p>We then obtain a file named <em>$SiteName.PublishSettings<\/em> in which are entered the usernames and passwords allowing access to the deployment server<em> MSDeploy<\/em> (in green) and to the FTP server (in blue):<\/p>\n<div id=\"attachment_4052\" class=\"wp-caption alignnone\">\n<p><img decoding=\"async\" class=\"wp-image-4052 size-full\" src=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/05\/publishsettings_9.png\" sizes=\"(max-width: 669px) 100vw, 669px\" srcset=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/05\/publishsettings_9.png 669w, https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/05\/publishsettings_9-300x257.png 300w\" alt=\"\" width=\"669\" height=\"574\"><\/p>\n<p class=\"wp-caption-text\">Figure 2: File poc-eval-****.PublishSettings<\/p>\n<\/div>\n<p>&nbsp;<\/p>\n<h2>Compromise<\/h2>\n<p>The practice we were referring to is as follows: often, the file<em> PublishSettings <\/em>is appended to the project&#039;s source code. The file then reaches the various stakeholders in the development chain (development teams, security auditors, quality engineers, etc.) and, in the most critical cases, it is published on online services such as <em>GitHub<\/em> or in the website directory (although\u2019<em>Azure<\/em> blocks access to this type of file from the browser by default), thus giving an attacker the opportunity to access and use the sensitive information stored there.<\/p>\n<p>Let&#039;s assume that we have obtained the file <em>PublishSettings<\/em> presented in the previous section. We simply need to follow the links. <em>publishUrl<\/em> and to enter the provided usernames and passwords.<\/p>\n<p>For example, we can connect to the FTP server and access the source code:<\/p>\n<div id=\"attachment_4040\" class=\"wp-caption alignnone\">\n<p><img decoding=\"async\" class=\"wp-image-4040 size-full\" src=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/05\/publishsettings_3.png\" sizes=\"(max-width: 748px) 100vw, 748px\" srcset=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/05\/publishsettings_3.png 748w, https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/05\/publishsettings_3-300x188.png 300w\" alt=\"\" width=\"748\" height=\"468\"><\/p>\n<p class=\"wp-caption-text\">Figure 3: Connecting to the FTP server<\/p>\n<\/div>\n<p>&nbsp;<\/p>\n<p>We can also add or delete files. Below, we have deleted <em>index.html<\/em> and added <em>poc_ftp.html<\/em>&nbsp;:<\/p>\n<div id=\"attachment_4041\" class=\"wp-caption alignnone\">\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-4041 size-full\" src=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/05\/publishsettings_4.png\" sizes=\"(max-width: 765px) 100vw, 765px\" srcset=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/05\/publishsettings_4.png 765w, https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/05\/publishsettings_4-300x157.png 300w\" alt=\"\" width=\"765\" height=\"401\"><\/p>\n<p class=\"wp-caption-text\">Figure 4: Editing FTP server content<\/p>\n<\/div>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>Our file <em>poc_ftp.html<\/em> is indeed accessible on the web application:<\/p>\n<div id=\"attachment_4042\" class=\"wp-caption alignnone\">\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-4042 size-full\" src=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/05\/publishsettings_5.png\" sizes=\"(max-width: 592px) 100vw, 592px\" srcset=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/05\/publishsettings_5.png 592w, https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/05\/publishsettings_5-300x53.png 300w\" alt=\"\" width=\"592\" height=\"104\"><\/p>\n<p class=\"wp-caption-text\">Figure 5: Access to poc_ftp.html<\/p>\n<\/div>\n<p>&nbsp;<\/p>\n<p>It is notably possible to execute system commands by dropping a <em>webshell<\/em>&nbsp;:<\/p>\n<div id=\"attachment_4043\" class=\"wp-caption alignnone\">\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-4043 size-full\" src=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/05\/publishsettings_6.png\" sizes=\"(max-width: 832px) 100vw, 832px\" srcset=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/05\/publishsettings_6.png 832w, https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/05\/publishsettings_6-300x95.png 300w, https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/05\/publishsettings_6-768x243.png 768w\" alt=\"\" width=\"832\" height=\"263\"><\/p>\n<p class=\"wp-caption-text\">Figure 6: Executing Windows system commands<\/p>\n<\/div>\n<p>&nbsp;<\/p>\n<p>Finally, we can access the application logs:<\/p>\n<div id=\"attachment_4044\" class=\"wp-caption alignnone\">\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-4044 size-full\" src=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/05\/publishsettings_7.png\" sizes=\"(max-width: 784px) 100vw, 784px\" srcset=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/05\/publishsettings_7.png 784w, https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/05\/publishsettings_7-300x150.png 300w, https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/05\/publishsettings_7-768x385.png 768w\" alt=\"\" width=\"784\" height=\"393\"><\/p>\n<p class=\"wp-caption-text\">Figure 7: Accessing application logs<\/p>\n<\/div>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>This log file contains the requests made to the web server. It includes the GET request we made to the server to access the file. <em>poc_eval.html&nbsp;<\/em>:<\/p>\n<div id=\"attachment_4078\" class=\"wp-caption alignnone\">\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-4078 size-full\" src=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/05\/7FB83AE4.png\" sizes=\"(max-width: 823px) 100vw, 823px\" srcset=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/05\/7FB83AE4.png 823w, https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/05\/7FB83AE4-300x42.png 300w, https:\/\/www.intrinsec.com\/wp-content\/uploads\/2018\/05\/7FB83AE4-768x107.png 768w\" alt=\"\" width=\"823\" height=\"115\"><\/p>\n<p class=\"wp-caption-text\">Figure 8: Web server access log<\/p>\n<\/div>\n<p>&nbsp;<\/p>\n<p>Numerous other log files are accessible on the FTP server: system logs containing information about the operating system, application logs storing the outputs of functions,&nbsp;<em>debug<\/em>, or extension logs indicating the name and version of extensions added to the application.<\/p>\n<h2>Recommendations<\/h2>\n<p>The content of this file is particularly sensitive and unencrypted; therefore, special attention should be paid to the permissions applied to it and the opportunities for reading by an illegitimate third party.<\/p>\n<p>Intrinsec recommends the following practices:<\/p>\n<ul>\n<li>Do not save the file <em>PublishSettings<\/em> in the project directory;<\/li>\n<li>Delete the file once it has been imported;<\/li>\n<li>Implement unit tests in the continuous integration pipeline to verify the absence of a P file<em>ublishSettings<\/em> in published directories;<\/li>\n<li>Include verification in the tests performed by your vulnerability scanners;<\/li>\n<li>Consider a specific use case in detection strategies for the different stakeholders in the development chain;<\/li>\n<li>Monitor the leakage or exposure of this type of document;<\/li>\n<li>Communicate the best practices outlined above to the development teams.<\/li>\n<\/ul>\n<p>&nbsp;[\/et_pb_text][\/et_pb_column]<br \/>\n\t\t\t[\/et_pb_row]<br \/>\n\t\t[\/et_pb_section]<\/p>","protected":false},"excerpt":{"rendered":"<p>[et_pb_section admin_label=&quot;section&quot;] [et_pb_row admin_label=&quot;row&quot;] [et_pb_column type=&quot;4_4&quot;][et_pb_text admin_label=&quot;Text&quot;]During recent penetration tests, we identified [\u2026]<\/p>","protected":false},"author":25,"featured_media":218149,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22],"tags":[],"class_list":["post-218148","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-veille-securite"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.0 (Yoast SEO v27.8) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Intrinsec - [Azure] Pratique de d\u00e9veloppement non s\u00e9curis\u00e9e : exposition d\u2019identifiants d\u2019acc\u00e8s<\/title>\n<meta name=\"description\" content=\"\u00c0 l\u2019occasion de r\u00e9cents tests d\u2019intrusion, nous avons identifi\u00e9 une pratique de d\u00e9veloppement exposant des identifiants d\u2019acc\u00e8s \u00e0 la plateforme Microsoft Azure Web Sites \u2013 service permettant de d\u00e9velopper et h\u00e9berger des applications web dans le cloud.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.intrinsec.com\/en\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"[Azure] Pratique de d\u00e9veloppement non s\u00e9curis\u00e9e : exposition d\u2019identifiants d\u2019acc\u00e8s\" \/>\n<meta property=\"og:description\" content=\"\u00c0 l\u2019occasion de r\u00e9cents tests d\u2019intrusion, nous avons identifi\u00e9 une pratique de d\u00e9veloppement exposant des identifiants d\u2019acc\u00e8s \u00e0 la plateforme Microsoft Azure Web Sites \u2013 service permettant de d\u00e9velopper et h\u00e9berger des applications web dans le cloud.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.intrinsec.com\/en\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\/\" \/>\n<meta property=\"og:site_name\" content=\"INTRINSEC\" \/>\n<meta property=\"article:published_time\" content=\"2018-11-13T14:19:55+00:00\" \/>\n<meta name=\"author\" content=\"Adrien Bouteiller\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@Intrinsec\" \/>\n<meta name=\"twitter:site\" content=\"@Intrinsec\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Adrien Bouteiller\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\\\/\"},\"author\":{\"name\":\"Adrien Bouteiller\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/person\\\/f66452546f5761d26bb4c6dfa4d9d1e6\"},\"headline\":\"[Azure] Pratique de d\u00e9veloppement non s\u00e9curis\u00e9e : exposition d\u2019identifiants d\u2019acc\u00e8s\",\"datePublished\":\"2018-11-13T14:19:55+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\\\/\"},\"wordCount\":881,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\\\/#primaryimage\"},\"thumbnailUrl\":\"\",\"articleSection\":[\"Veille S\u00e9curit\u00e9\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.intrinsec.com\\\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\\\/\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\\\/\",\"name\":\"Intrinsec - [Azure] Pratique de d\u00e9veloppement non s\u00e9curis\u00e9e : exposition d\u2019identifiants d\u2019acc\u00e8s\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\\\/#primaryimage\"},\"thumbnailUrl\":\"\",\"datePublished\":\"2018-11-13T14:19:55+00:00\",\"description\":\"\u00c0 l\u2019occasion de r\u00e9cents tests d\u2019intrusion, nous avons identifi\u00e9 une pratique de d\u00e9veloppement exposant des identifiants d\u2019acc\u00e8s \u00e0 la plateforme Microsoft Azure Web Sites \u2013 service permettant de d\u00e9velopper et h\u00e9berger des applications web dans le cloud.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.intrinsec.com\\\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\\\/#primaryimage\",\"url\":\"\",\"contentUrl\":\"\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\\\/\\\/www.intrinsec.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"[Azure] Pratique de d\u00e9veloppement non s\u00e9curis\u00e9e : exposition d\u2019identifiants d\u2019acc\u00e8s\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#website\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/\",\"name\":\"INTRINSEC\",\"description\":\"Notre m\u00e9tier , Prot\u00e9ger le v\u00f4tre\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.intrinsec.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#organization\",\"name\":\"INTRINSEC\",\"alternateName\":\"ISEC\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/libellule.png\",\"contentUrl\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/libellule.png\",\"width\":1322,\"height\":1322,\"caption\":\"INTRINSEC\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/Intrinsec\",\"https:\\\/\\\/fr.linkedin.com\\\/company\\\/intrinsec\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UC0trUZAHNZOUbxYnNdecM4A\"],\"description\":\"soci\u00e9t\u00e9 de consulting, pure player cybers\u00e9curit\u00e9 fran\u00e7ais et europ\u00e9en depuis plus de 30ans, sp\u00e9cialiste dans la s\u00e9curit\u00e9 offensive & audit (pentest\\\/red team), GRC, et services IMSS comme le SOC, CTI et CERT Intrinsec est qualifi\u00e9 PASSI Elev\u00e9, PRIS Elev\u00e9 et PACS par l'ANSSI\",\"email\":\"contact@intrinsec.com\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/person\\\/f66452546f5761d26bb4c6dfa4d9d1e6\",\"name\":\"Adrien Bouteiller\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=retro&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=retro&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=retro&r=g\",\"caption\":\"Adrien Bouteiller\"},\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/en\\\/author\\\/adrien-bouteiller\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Intrinsec - [Azure] Insecure development practice: exposing access credentials","description":"During recent penetration tests, we identified a development practice exposing access credentials to the Microsoft Azure Web Sites platform \u2013 a service for developing and hosting web applications in the cloud.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.intrinsec.com\/en\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\/","og_locale":"en_US","og_type":"article","og_title":"[Azure] Pratique de d\u00e9veloppement non s\u00e9curis\u00e9e : exposition d\u2019identifiants d\u2019acc\u00e8s","og_description":"\u00c0 l\u2019occasion de r\u00e9cents tests d\u2019intrusion, nous avons identifi\u00e9 une pratique de d\u00e9veloppement exposant des identifiants d\u2019acc\u00e8s \u00e0 la plateforme Microsoft Azure Web Sites \u2013 service permettant de d\u00e9velopper et h\u00e9berger des applications web dans le cloud.","og_url":"https:\/\/www.intrinsec.com\/en\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\/","og_site_name":"INTRINSEC","article_published_time":"2018-11-13T14:19:55+00:00","author":"Adrien Bouteiller","twitter_card":"summary_large_image","twitter_creator":"@Intrinsec","twitter_site":"@Intrinsec","twitter_misc":{"Written by":"Adrien Bouteiller","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.intrinsec.com\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\/#article","isPartOf":{"@id":"https:\/\/www.intrinsec.com\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\/"},"author":{"name":"Adrien Bouteiller","@id":"https:\/\/www.intrinsec.com\/#\/schema\/person\/f66452546f5761d26bb4c6dfa4d9d1e6"},"headline":"[Azure] Pratique de d\u00e9veloppement non s\u00e9curis\u00e9e : exposition d\u2019identifiants d\u2019acc\u00e8s","datePublished":"2018-11-13T14:19:55+00:00","mainEntityOfPage":{"@id":"https:\/\/www.intrinsec.com\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\/"},"wordCount":881,"commentCount":0,"publisher":{"@id":"https:\/\/www.intrinsec.com\/#organization"},"image":{"@id":"https:\/\/www.intrinsec.com\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\/#primaryimage"},"thumbnailUrl":"","articleSection":["Veille S\u00e9curit\u00e9"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.intrinsec.com\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.intrinsec.com\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\/","url":"https:\/\/www.intrinsec.com\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\/","name":"Intrinsec - [Azure] Insecure development practice: exposing access credentials","isPartOf":{"@id":"https:\/\/www.intrinsec.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.intrinsec.com\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\/#primaryimage"},"image":{"@id":"https:\/\/www.intrinsec.com\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\/#primaryimage"},"thumbnailUrl":"","datePublished":"2018-11-13T14:19:55+00:00","description":"During recent penetration tests, we identified a development practice exposing access credentials to the Microsoft Azure Web Sites platform \u2013 a service for developing and hosting web applications in the cloud.","breadcrumb":{"@id":"https:\/\/www.intrinsec.com\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.intrinsec.com\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.intrinsec.com\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\/#primaryimage","url":"","contentUrl":""},{"@type":"BreadcrumbList","@id":"https:\/\/www.intrinsec.com\/azure-pratique-de-developpement-non-securisee-exposition-didentifiants-dacces\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.intrinsec.com\/"},{"@type":"ListItem","position":2,"name":"[Azure] Pratique de d\u00e9veloppement non s\u00e9curis\u00e9e : exposition d\u2019identifiants d\u2019acc\u00e8s"}]},{"@type":"WebSite","@id":"https:\/\/www.intrinsec.com\/#website","url":"https:\/\/www.intrinsec.com\/","name":"INTRINSEC","description":"Our job is to protect yours.","publisher":{"@id":"https:\/\/www.intrinsec.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.intrinsec.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.intrinsec.com\/#organization","name":"INTRINSEC","alternateName":"ISEC","url":"https:\/\/www.intrinsec.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.intrinsec.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/02\/libellule.png","contentUrl":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/02\/libellule.png","width":1322,"height":1322,"caption":"INTRINSEC"},"image":{"@id":"https:\/\/www.intrinsec.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/Intrinsec","https:\/\/fr.linkedin.com\/company\/intrinsec","https:\/\/www.youtube.com\/channel\/UC0trUZAHNZOUbxYnNdecM4A"],"description":"Intrinsec, a consulting firm and pure-play French and European cybersecurity provider for over 30 years, specializes in offensive security and auditing (penetration testing\/red teams), GRC, and IMSS services such as SOC, CTI, and CERT. Intrinsec is qualified at PASSI High, PRIS High, and PACS levels by ANSSI.","email":"contact@intrinsec.com"},{"@type":"Person","@id":"https:\/\/www.intrinsec.com\/#\/schema\/person\/f66452546f5761d26bb4c6dfa4d9d1e6","name":"Adrien Bouteiller","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=retro&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=retro&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=retro&r=g","caption":"Adrien Bouteiller"},"url":"https:\/\/www.intrinsec.com\/en\/author\/adrien-bouteiller\/"}]}},"_links":{"self":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts\/218148","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/comments?post=218148"}],"version-history":[{"count":0,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts\/218148\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/media?parent=218148"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/categories?post=218148"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/tags?post=218148"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}