Skip to main content

Lack of protection against deletion - Azure Key Vault

Description​

Some Azure Key Vaults instances do not enable properties that allow secrets to be recovered in the event of accidental deletion or by malicious actors.

Impact​

Delete sensitive secrets by accident with no chance of recovery

Recommendation​

Enable the properties EnableSoftDelete and EnablePurgeProtection in every Azure Key Vault (AKV) instance.

Threat​

Authenticated attacker from the Internet with write permissions in the vault

Expected Remediation Time​

⌚ 20 minutes.

Score​

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base​

  • Attack vector: N
  • Attack complexity: L
  • Privileges required: H
  • User interaction: N
  • Scope: U
  • Confidentiality: N
  • Integrity: N
  • Availability: H

Temporal​

  • Exploit code madurity: P
  • Remediation level: O
  • Report confidence: C

Result​

  • Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
  • Score:
    • Base: 4.9
    • Temporal: 4.4
  • Severity:
    • Base: Medium
    • Temporal: Medium

Code Examples​

Compliant code​

All resources have protection against deletion enabled

resource "azurerm_key_vault" "not_vulnerable" {
  name                       = "examplekeyvault"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  tenant_id                  = data.azurerm_client_config.current.tenant_id
  soft_delete_retention_days = 7
  soft_delete_enabled        = true
  purge_protection_enabled   = true
}

Non compliant code​

The resource does not have any protection against deletion enabled

resource "azurerm_key_vault" "vulnerable" {
  name                       = "examplekeyvault"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  tenant_id                  = data.azurerm_client_config.current.tenant_id
}

Using the Azure CLI, the following command checks production Azure Key Vaults are recoverable

$ az keyvault show
     --name {keyvault_id}
     --query 'properties.{"enableSoftDelete":enableSoftDelete,"enablePurgeProtection":enablePurgeProtection}'

If the command output returns null for both "enablePurgeProtection" and "enableSoftDelete" configuration attributes, the verified Microsoft Azure Key Vault instance and its objects are not recoverable, which means that the resource does not have protection against deletion.

Requirements​

free trial

Search for vulnerabilities in your apps for free with our automated security testing! Start your 21-day free trial and discover the benefits of our Continuous Hacking Machine Plan. If you prefer a full service that includes the expertise of our ethical hackers, don't hesitate to contact us for our Continuous Hacking Squad Plan.