Microsoft has disclosed the patching of two (2) critical vulnerabilities in their Azure cloud platform after Orca Security published a blog post with a working proof-of-concept (PoC). Of the two (2) bugs, one (1) impacts Azure Bastion and the other affects Azure Container Registry, ultimately stemming from issues in Azure’s Network Watcher connection troubleshooter. If exploited, these flaws could allow threat actors to conduct cross-site scripting (XSS) attacks, injecting malicious scripts into trusted websites that execute on unsuspecting victim environments. To become compromised, a victim would need to visit an attacker-controlled webpage via Azure Bastion. Successful exploitation could allow attackers to access the victim’s session in Bastion or Container Registry, as well as make configuration changes, tamper with privileged data, and move laterally. This flaw is not an isolated incident, and a Microsoft spokesperson has stated that their engineers have “updated their internal rules to improve scanning for this class of bug across all of Microsoft’s products and services” to prevent future XSS attacks facilitated by these types of vulnerabilities. Both vulnerabilities were patched by May 24, 2023, and there is currently no evidence that either flaw has been actively exploited in the wild. To prevent exploitation, CTIX analysts recommend that all Microsoft administrators and users ensure that their Azure infrastructure is up to date with the latest security patch.