What the Function: A Deep Dive into Azure Function App Security

As organizations have evolved from the “Lift and Shift” cloud migration strategy to building “Cloud Native” applications, there has been a significant increase in the usage of Platform as a Service (PaaS) services in the cloud. The Azure Function App service is a commonly used resource in this space, as it provides easy to deploy application hosting. While the serverless service offers a wide variety of convenient features, it also comes with its own security challenges. They discussed how the service is utilized by Azure customers and some of the architecture design flaws that can lead to privilege escalation scenarios. Additionally, we will be covering a recently remediated privilege escalation issue that resulted in the Azure “Reader” RBAC role gaining code execution privileges in Function App containers.

Also covered in this talk is a tool they developed called FuncoPop, which automates the exploitation of write access on a Function App’s Storage Account. This tool will allow you to gain cleartext access to the Function App keys, and will generate Managed Identity tokens that can be used to pivot to the Function App’s identity. They also included some additional research on how we were able to abuse the Function App service to gain access to Managed Identity certificates associated with the resources. Finally, we will also include best practices and recommendations on how defenders can implement policy and configuration changes that help mitigate these issues. As part of this research, Karl created the MicroBurst toolkit (https://github.com/NetSPI/Microburst) to house many of the PowerShell tools that he uses for testing Azure. In 2021, Karl co-authored the book “Penetration Testing Azure for Ethical Hackers” with David Okeyode.