2025-05-16 –, Salle de bal
Azure Logic Apps, a powerful tool for automating workflows and system integration, plays a pivotal role in modern cloud operations. However, these capabilities come with hidden risks numerous potential security vulnerabilities and attack vectors that can be exploited due to unnoticed misconfigurations. This session will examine the complex attack surface of Azure Logic Apps, revealing how attackers can manipulate its features to compromise cloud environments.
We will cover critical topics such as the exposure of sensitive data due to improperly secured Logic Apps, the execution of inline C# code to perform malicious actions, privilege escalation within storage accounts, hijacking API connections, and techniques for facilitating cloud-to-on-premises lateral movement. Additionally, we will address the often-overlooked risks associated with custom authorization logic, showcasing real-world examples of how weak authentication mechanisms can be bypassed, resulting in unauthorized access and data breaches.
Furthermore, we will explore the broader implications of misconfigured Logic Apps, such as overly permissive role-based access control (RBAC), insecure service principals, and unprotected connections to external systems. These misconfigurations can open the door to privilege escalation, unauthorized access, and even cloud-to-cloud or cloud-to-on-premises lateral movement.
By examining these threats and their countermeasures, organizations can strengthen the security of their Logic App implementations and ensure resilient cloud operations. Real-world scenarios and exploitation techniques will be dissected to highlight critical vulnerabilities in these workflows.
English
Chirag Savla is a cyber security professional with 9+ years of experience. His areas of interest include penetration testing, red teaming, azure and active directory security, and post-exploitation research. For fun, he enjoys creating open-source tools and exploring new attack methodologies in his leisure. Chirag has worked extensively on Azure, Active Directory attacks and defense, and bypassing detection mechanisms. He is the author of multiple open source tools such as Process Injection, Callidus, and others. He has presented at many conferences and local meetups and has trained people in international conferences like Blackhat, BSides Milano, Wild West Hackin’ Fest, HackSpaceCon and VulnCon.
Raunak Parmar works as a senior cloud security engineer at White Knight Labs. His areas of interest include web penetration testing, Azure/AWS security, source code review, scripting, and development. He has 4+ years of experience in information security. He enjoys researching new attack methodologies and creating open-source tools that can be used during cloud red team activities. He has worked extensively on Azure and AWS and is the author of Vajra, an offensive cloud security tool. He has spoken at multiple respected security conferences like Black Hat, Defcon RTV, MCTTP, HackSpaceCon, RootCon, and also at local meetups.