Azure APIM Cross-Tenant Signup Bypass

Summary

A significant security vulnerability has been identified within the Azure API Management (APIM) Developer Portal, allowing unauthorized account registrations across different tenant instances. Even when administrators have disabled user signup via the portal UI, attackers can exploit this vulnerability to gain access to protected resources, such as API documentation and subscription keys.

Disclosure Timeline

Vulnerability Details

The Issue

When Basic Authentication is enabled in Azure APIM, the option to disable user registration in the portal UI fails to restrict access to the underlying signup API endpoint, which remains active and accessible.

Root Cause

This vulnerability arises from two interconnected issues:

1. UI-only restriction: Disabling signup only hides the form from the portal interface.
2. No tenant validation: The signup API does not check the request origin, allowing any registration request to be processed regardless of tenant boundaries.

Attack Vector

To exploit this vulnerability, two APIM instances are necessary:

1. Attacker's instance: Any APIM Developer Portal with signup enabled.
2. Target instance: A victim's APIM Developer Portal where signup is supposedly disabled.

Steps:

1. The attacker accesses their own APIM Developer Portal signup page.
2. The signup request is intercepted and the Host header is manipulated.
3. Upon submitting the modified request, an account is illegitimately created on the target APIM instance.

POST /signup HTTP/1.1
Host: target-apim.developer.azure-api.net  <-- Modified host header
Origin: https://attacker-apim.developer.azure-api.net
Content-Type: application/json

{"challenge":{"..."},"signupData":{"email":"attacker@email.com","..."}}

This manipulation highlights the issue: simply disabling signup in the UI does not disable the active API.

Impact

• Cross-tenant account creation: Register accounts on any APIM instance with Basic Authentication enabled.
• Bypass of administrative controls: Existing signup controls are ineffective.
• Exposure to sensitive information: Attackers may gain access to private API documentation and subscription keys.
• Threat of unauthorized access: External attackers can infiltrate internal portals labeled as "secure."

Affected Configurations

APIM instances are at risk if:

• Basic Authentication is configured, despite signup being disabled in the UI.
• The Developer Portal is publicly accessible.

Instances are NOT vulnerable if:

• Basic Authentication has been completely removed.
• Only Azure AD/OAuth authentication is present.
• The Developer Portal is either not deployed or disabled.

Verification Script

A Python verification script is included to assess the vulnerability of an APIM instance.

Usage Examples

python apim_vuln_checker.py https://your-apim.developer.azure-api.net

The checker assesses endpoint accessibility and identifies if the Basic Authentication signup API is active, while also checking for any visible signup UI elements.

Mitigation Strategies

Immediate Actions

1. Remove Basic Authentication identity provider entirely from the Azure Portal.
2. Audit existing user accounts for any unauthorized registrations.
3. Transition to using Azure AD authentication exclusively to ensure robust security controls.

Long-term Recommendations

• Always utilize Azure AD authentication.
• Avoid relying solely on UI-level controls to restrict API access.
• Regularly monitor activity on the Developer Portal and conduct audits of existing user accounts.

Microsoft's Response

The vulnerability was disclosed to the Microsoft Security Response Center (MSRC), which has deemed this issue as "by design," dismissing it as a security vulnerability despite the evident risks associated with cross-tenant account creation.

Author

Mihalis Haatainen
Bountyy Oy, a Finnish security research and penetration testing firm.

References

• Azure API Management Documentation
• [APIM Developer Portal Overview](https://docs.microsoft.