Skip to main content

Lack of protection against deletion - Azure Key Vault

Description

Some Azure Key Vaults instances do not enable properties that allow secrets to be recovered in the event of accidental deletion or by malicious actors.

Impact

Delete sensitive secrets by accident with no chance of recovery

Recommendation

Enable the properties EnableSoftDelete and EnablePurgeProtection in every Azure Key Vault (AKV) instance.

Threat

Authenticated attacker from the Internet with write permissions in the vault

Expected Remediation Time

⌚ 20 minutes.

Score

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base

  • Attack vector: N
  • Attack complexity: L
  • Privileges required: H
  • User interaction: N
  • Scope: U
  • Confidentiality: N
  • Integrity: N
  • Availability: H

Temporal

  • Exploit code madurity: P
  • Remediation level: O
  • Report confidence: C

Result

  • Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
  • Score:
    • Base: 4.9
    • Temporal: 4.4
  • Severity:
    • Base: Medium
    • Temporal: Medium

Code Examples

Compliant code

All resources have protection against deletion enabled

resource "azurerm_key_vault" "not_vulnerable" {
name = "examplekeyvault"
location = azurerm_resource_group.example.location
resource_group_name = azurerm_resource_group.example.name
tenant_id = data.azurerm_client_config.current.tenant_id
soft_delete_retention_days = 7
soft_delete_enabled = true
purge_protection_enabled = true
}

Non compliant code

The resource does not have any protection against deletion enabled

resource "azurerm_key_vault" "vulnerable" {
name = "examplekeyvault"
location = azurerm_resource_group.example.location
resource_group_name = azurerm_resource_group.example.name
tenant_id = data.azurerm_client_config.current.tenant_id
}

Using the Azure CLI, the following command checks production Azure Key Vaults are recoverable

$ az keyvault show
--name {keyvault_id}
--query 'properties.{"enableSoftDelete":enableSoftDelete,"enablePurgeProtection":enablePurgeProtection}'

If the command output returns null for both "enablePurgeProtection" and "enableSoftDelete" configuration attributes, the verified Microsoft Azure Key Vault instance and its objects are not recoverable, which means that the resource does not have protection against deletion.

Requirements

free trial

Search for vulnerabilities in your apps for free with our automated security testing! Start your 21-day free trial and discover the benefits of our Continuous Hacking Machine Plan. If you prefer a full service that includes the expertise of our ethical hackers, don't hesitate to contact us for our Continuous Hacking Squad Plan.