Cross Site Request Forgery on Azure

Cross Site Request Forgery (CSRF) in Azure environments often exploits the platform's extensive integration capabilities and default authentication flows. Azure's service-to-service communication patterns create unique CSRF attack vectors that differ from traditional web applications.

In Azure Function Apps, CSRF attacks frequently target the default HTTP trigger endpoints. When Azure Functions use anonymous authentication or overly permissive CORS policies, attackers can craft malicious requests that appear to originate from trusted Azure services. For example, an Azure Logic App might trigger a Function App with sensitive parameters, and a CSRF attack could manipulate those parameters before they reach the backend logic.

Azure API Management (APIM) presents another CSRF vulnerability surface. When APIM instances are configured with back-end policies that don't validate request origins, attackers can exploit the trust relationship between APIM and backend services. The following code demonstrates a vulnerable Azure Function that lacks CSRF protection:

using Microsoft.AspNetCore.Mvc;
using Microsoft.Azure.WebJobs;
using Microsoft.Azure.WebJobs.Extensions.Http;
using Microsoft.AspNetCore.Http;
using System.Threading.Tasks;

public static class VulnerableFunction
{
    [FunctionName("ProcessPayment")]
    public static async Task<JsonResult> Run(
        [HttpTrigger(AuthorizationLevel.Anonymous, "post", Route = "payment")]
        HttpRequest req)
    {
        var amount = await req.ReadFromJsonAsync<decimal>();
        var userId = req.Query["userId"];
        
        // No CSRF validation
        await ProcessPaymentAsync(amount, userId);
        return new JsonResult(new { success = true });
    }
}

Azure's managed identity system can also be exploited through CSRF. When applications use Azure AD authentication but don't validate the token's intended audience, attackers can intercept or replay authentication flows. The default Azure App Service authentication middleware sometimes allows CSRF if not properly configured with anti-forgery tokens.

Storage Account endpoints in Azure create additional CSRF risks. When Azure Storage REST APIs are accessed without proper validation, attackers can trick authenticated users into making unauthorized modifications to blob containers or table storage. The cross-origin requests to storage endpoints often bypass traditional CSRF protections if CORS isn't properly restricted.

Detecting CSRF vulnerabilities in Azure requires understanding the platform's unique authentication and request patterns. Azure's built-in security scanning tools provide limited CSRF detection, making third-party solutions essential for comprehensive coverage.

Azure Security Center can identify some CSRF-related issues through its API scanning capabilities, but it often misses context-specific vulnerabilities in Azure Functions and Logic Apps. The security center flags generic authentication issues but doesn't specifically test for CSRF in Azure's service-to-service communication patterns.

middleBrick's Azure-specific CSRF detection analyzes the authentication flow and request patterns unique to Azure services. The scanner tests for:

• Missing anti-forgery tokens in Azure Function HTTP triggers
• Improper CORS configuration in Azure API Management
• Unvalidated Azure AD token audiences
• Excessive permissions in Azure Managed Identity configurations
• Insecure default authentication levels in Azure App Service

The scanner examines the actual request flow between Azure services, identifying where trust relationships can be exploited. For example, it tests whether an Azure Logic App can be tricked into calling a Function App with manipulated parameters by analyzing the request headers and authentication tokens.

middleBrick's CLI tool provides Azure-specific CSRF scanning with the following command:

npx middlebrick scan https://your-azure-function.azurewebsites.net/api/endpoint --azure

This Azure-specific scan mode includes additional checks for Azure's unique request patterns and authentication flows. The scanner validates that anti-forgery tokens are properly implemented and that Azure AD tokens are validated against their intended audience.

For continuous Azure security monitoring, middleBrick's GitHub Action can be configured to scan Azure Function Apps and API Management instances as part of your CI/CD pipeline:

name: Azure Security Scan
on: [push, pull_request]

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v2
    - name: Run middleBrick Azure Scan
      run: |
        npx middlebrick scan https://your-azure-function.azurewebsites.net/api/endpoint --azure --threshold B
      env:
        MIDDLEBRICK_API_KEY: ${{ secrets.MIDDLEBRICK_API_KEY }}

This configuration ensures that any CSRF vulnerabilities introduced during development are caught before deployment to Azure.

Remediating CSRF vulnerabilities in Azure requires leveraging platform-specific security features and following Azure's authentication best practices. The most effective approach combines anti-forgery tokens with Azure's built-in authentication mechanisms.

For Azure Functions, implement anti-forgery token validation using ASP.NET Core's built-in middleware. Here's a secure implementation:

using Microsoft.AspNetCore.Mvc;
using Microsoft.Azure.WebJobs;
using Microsoft.Azure.WebJobs.Extensions.Http;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Antiforgery;
using System.Threading.Tasks;

public static class SecureFunction
{
    private static readonly IAntiforgery _antiforgery;

    [FunctionName("SecurePayment")]
    public static async Task<JsonResult> Run(
        [HttpTrigger(AuthorizationLevel.Anonymous, "post", Route = "payment")]
        HttpRequest req,
        IAntiforgery antiforgery)
    {
        var token = antiforgery.GetAndStoreTokens(req);
        if (!antiforgery.IsRequestValid(req))
        {
            return new JsonResult(new { error = "Invalid CSRF token" }) { StatusCode = 400 };
        }
        
        var amount = await req.ReadFromJsonAsync<decimal>();
        var userId = req.Query["userId"];
        
        await ProcessPaymentAsync(amount, userId);
        return new JsonResult(new { success = true });
    }
}

For Azure API Management, implement request validation policies that check for anti-forgery tokens and validate request origins:

<policies>
    <!-- Validate CSRF token -->
    <inbound>
        <set-variable name="csrf-token" value="@(
            context.Request.Headers.GetValueOrDefault("X-CSRF-Token", string.Empty)
        )" />
        <choose>
            <when condition="@(!string.IsNullOrEmpty(context.Variables["csrf-token"]))">
                <validate-jwt header-name="X-CSRF-Token" 
                             failed-validation-httpcode="403" 
                             failed-validation-error-message="Invalid CSRF token" />
            </when>
            <otherwise>
                <return-response>
                    <status code="403" />
                    <body>CSRF token required</body>
                </return-response>
            </otherwise>
        </choose>
    </inbound>
</policies>

Azure App Service authentication can be configured to prevent CSRF by enabling token validation and restricting allowed origins:

// In Startup.cs or Program.cs
builder.Services.AddAuthentication(options =>
{
    options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
})
.AddCookie(options =>
{
    options.Cookie.SameSite = SameSiteMode.Strict;
    options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
    options.Cookie.HttpOnly = true;
})
.AddJwtBearer(options =>
{
    options.TokenValidationParameters.ValidateAudience = true;
    options.TokenValidationParameters.ValidateIssuer = true;
});

For Azure Logic Apps, implement request validation using the built-in security features:

// Logic App trigger with validation
@triggerBody()?['amount']
@triggerBody()?['userId']
@triggerOutputs()?['headers']['X-CSRF-Token']

// Validate token in subsequent actions
@equals(triggerOutputs()?['headers']['X-CSRF-Token'], 'expected-token-value')

Azure Storage accounts should implement shared key authorization and restrict cross-origin requests:

// Azure CLI to restrict CORS
az storage cors add --services b --origins 'https://trusted-domain.com' --methods GET POST PUT --allowed-headers '*' --exposed-headers '*' --max-age 200

// Use SAS tokens with restricted permissions
var sasToken = new SharedAccessBlobPolicy 
{
    Permissions = SharedAccessBlobPermissions.Read,
    SharedAccessStartTime = DateTime.UtcNow.AddMinutes(-15),
    SharedAccessExpiryTime = DateTime.UtcNow.AddHours(1)
};

Implementing these Azure-specific CSRF protections significantly reduces the attack surface while maintaining the platform's integration capabilities.