Microsoft has patched a critical vulnerability in an Azure inspection tool that could be exploited by unauthenticated threat actors to conduct remote code execution (RCE). The flaw, tracked as CVE-2023-23383, exists in Azure Service Fabric Explorer (SFX) and has been dubbed “Super FabriXss”, an homage to the “FabriXss” vulnerability patched in October 2022 by Microsoft. Azure SFX is a “distributed systems platform” that streamlines the ability to package, deploy, and manage microservices and containers, as well as assist with development and management of cloud applications. The vulnerability is a reflected cross-site scripting (XSS) flaw that gives unauthenticated attackers the ability to upload malicious scripts to trusted websites, compromising any unsuspecting victims who visit the site. The vulnerability received a CVSS score of 8.2/10, significantly higher than the original FabriXss flaw which had a CVSS of 6.2/10. This is due to the fact that the attacker can achieve full RCE without the prior need to authenticate as an administrative user. If successfully exploited, attackers would be able to launch follow-on attacks like dropping malware, as well as take complete control of affected systems. This vulnerability has been patched, and CTIX analysts urge users to ensure that they are running the most recent secure version of the platform.