Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Microsoft

## https://sploitus.com/exploit?id=4997B647-9EB1-5AFF-AFCD-D7851339488E
# CVE-2026-42826 — Azure DevOps Information Disclosure PoC

## Overview

| Field | Value |
|-------|-------|
| **CVE** | CVE-2026-42826 |
| **CVSS** | 10.0 Critical (Microsoft) / 7.5 High (NVD) |
| **CWE** | CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) |
| **GHSA** | [GHSA-gmwx-3xm2-9fx8](https://github.com/advisories/GHSA-gmwx-3xm2-9fx8) |
| **Affected** | Azure DevOps Services, Azure DevOps Server 2022/2025 |
| **Patched** | Azure DevOps Server 2026.0.1+ (Services patched server-side) |
| **Discoverer** | Noa Royzman (Microsoft) |

## Vulnerability Description

Azure DevOps can serve pipeline configuration, variable group contents, and build artifacts to **unauthenticated** HTTP requests under certain conditions. A remote attacker sends crafted requests to the Azure DevOps REST API and receives JSON responses containing:

- Pipeline YAML configurations
- Variable group metadata (including names of secret variables)
- Service connection identifiers
- Build log fragments
- Repository contents

**No credentials are required** when the target project is configured for public visibility, or when an internal API endpoint fails to enforce authentication checks before returning data.

### CVSS Vector
```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — 10.0 Critical
```

## Attack Vectors

### 1. Unauthenticated API Access (Public Projects)
Organizations with public projects enabled expose repos, pipelines, artifacts, and work items to the unauthenticated internet.

### 2. Authentication Bypass
Specific internal API endpoints fail to enforce authentication checks before returning sensitive data.

### 3. Pipeline YAML Reconnaissance
Public project pipeline YAML files reference service connections by name and variable groups by name, revealing Azure subscription structure, deployment targets, registry URLs, and environment names.

### 4. Service Connection Extraction
Service connection metadata (Azure subscription IDs, tenant IDs, Kubernetes cluster IDs) is exposed via the API.

### 5. Variable Group Harvesting
Non-secret variable values are visible in the UI, returned by the API, and printed to build logs.

### 6. Build Log Fragment Extraction
Build logs may contain sensitive configuration data, environment variables, and infrastructure details.

## Files

| File | Purpose |
|------|---------|
| `exploit.py` | Main exploit — 6 attack vectors, secret scanning, report generation |
| `detect.py` | Detection & hardening checker for Azure DevOps instances |
| `test_exploit.py` | Unit tests (30+ tests validating all exploit functionality) |

## Documentation

| Document | Content |
|----------|---------|
| [USAGE.md](USAGE.md) | Detailed usage guide with step-by-step instructions |
| [DIAGRAM.md](DIAGRAM.md) | Structure diagrams and attack flow visualization |

## Usage

### Quick Start (Unauthenticated Scan)

```bash
# Check if organization has publicly exposed projects
python3 exploit.py -u https://dev.azure.com/targetorg
```

### Full Exploitation (With PAT)

```bash
# Full exploitation with Personal Access Token
python3 exploit.py -u https://dev.azure.com/targetorg --pat YOUR_PAT_TOKEN

# Target specific project
python3 exploit.py -u https://dev.azure.com/targetorg --pat YOUR_PAT --project MyProject

# Save report to file
python3 exploit.py -u https://dev.azure.com/targetorg --pat YOUR_PAT -o report.json
```

### On-Premises Azure DevOps Server

```bash
python3 exploit.py -u https://tfs.company.local/tfs/DefaultCollection --pat YOUR_PAT
```

### Detection & Hardening Check

```bash
python3 detect.py -u https://dev.azure.com/targetorg --pat YOUR_PAT
```

### Run Tests

```bash
python3 test_exploit.py
```

## Impact

- **Source code exfiltration**: All repository contents accessible
- **Credential exposure**: Service connection names, Azure subscription IDs, tenant IDs
- **Pipeline reconnaissance**: YAML configs reveal infrastructure topology
- **Variable harvesting**: Non-secret variable values in plaintext
- **Build log analysis**: Sensitive data in log fragments
- **Lateral movement planning**: Infrastructure mapping for targeted attacks

## Attack Flow Diagram

```
Attacker              Azure DevOps API
  │                         │
  │  GET /_apis/projects    │
  │  (no auth)              │
  │ ──────────────────────► │
  │                         │
  │  200 OK                 │
  │  { projects: [...] }    │
  │ ◄────────────────────── │
  │                         │
  │  GET /proj/_apis/       │
  │  pipelines              │
  │ ──────────────────────► │
  │                         │
  │  200 OK                 │
  │  { YAML configs }       │
  │ ◄────────────────────── │
  │                         │
  │  GET /proj/_apis/       │
  │  variablegroups         │
  │ ──────────────────────► │
  │                         │
  │  200 OK                 │
  │  { variables: {...} }   │
  │ ◄────────────────────── │
  │                         │
  │  Extract secrets,       │
  │  map infrastructure     │
  │                         │
```

See [DIAGRAM.md](DIAGRAM.md) for full architecture diagrams.

## Mitigation

1. **Set all projects to private** — Disable public project visibility
2. **Block public projects at org level** — Set org policy to prevent future public projects
3. **Mark all sensitive variables as secret** — Non-secret variables are exposed via API
4. **Restrict service connections** — Disable "Allow all pipelines" on service connections
5. **Use scoped PATs** — Limit PAT scope to `Code (Read)` with 90-day expiry
6. **Scan build logs** — Remove sensitive data from log output
7. **Apply security update** — Azure DevOps Server 2026.0.1+

## References

- [NVD Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-42826)
- [GitHub Advisory GHSA-gmwx-3xm2-9fx8](https://github.com/advisories/GHSA-gmwx-3xm2-9fx8)
- [Microsoft Security Update Guide](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42826)
- [CWE-200](https://cwe.mitre.org/data/definitions/200.html)

## License

MIT