UPDATE to 5/10/2022 FLASH UPDATE: Microsoft has added security patch improvements recommended by Orca Security researchers to a critical command injection vulnerability originally fixed in April 2022, dubbed “SynLapse.” This flaw impacts the Azure cloud platform’s Data Factory and Synapse Pipelines and, if exploited, could allow an attacker running jobs in these environments to perform remote code execution (RCE) across the shared Integration Runtime (IR). Successful exploitation allows malicious attackers to pilfer sensitive data like service certificates/keys, passwords, and API tokens, allowing for a complete takeover of other tenants’ Synapse cloud environments. The flaw, tracked as CVE-2022-29972, specifically exists in the third-party Open Database Connectivity (ODBC) driver utilized for establishing a connection with Azure Data Factory and Azure Synapse Pipelines. Although this flaw was patched in April, cybersecurity researchers were quickly able to repeatedly bypass the security fixes, forcing Microsoft to urge customers to implement a manual mitigation technique alongside the patch by configuring a Managed Virtual Network isolating their workspaces from the internet. At this time, Microsoft has incorporated two (2) permanent safeguards which mitigate threat actor workarounds. The first safeguard is placing the shared IRs within ephemeral sandboxed VMs so that, even if an attacker successfully executes code, it would never be shared between two (2) tenants and would prevent the attacker from being able to access the sensitive data. The second safeguard is to limit access to the internal management server API by using scoped tokens, which would prevent threat actors from using the certificate to elevate their privileges and, in turn, prevent access to other tenants’ information. CTIX analysts urge all Data Factory and Synapse users to update to the latest stable version immediately.