CVE-2021-42306: Azure AD Information Disclosure Flaw

CVE-2021-42306 Overview

An information disclosure vulnerability exists in Microsoft Azure Active Directory when a user or application uploads unprotected private key data as part of an authentication certificate keyCredential on an Azure AD Application or Service Principal. This vulnerability allows any user or service within the tenant that has application read access to read the private key data that was added to the application, potentially enabling unauthorized access to protected resources.

Critical Impact

Tenant users or services with application read access can extract private key material from Azure AD Applications and Service Principals, potentially compromising authentication mechanisms and enabling unauthorized access to protected Azure resources.

Affected Products

• Microsoft Azure Active Directory
• Microsoft Azure Active Site Recovery
• Microsoft Azure Automation
• Microsoft Azure Migrate

Discovery Timeline

• 2021-11-24 - CVE-2021-42306 published to NVD
• 2026-02-24 - Last updated in NVD database

Technical Details for CVE-2021-42306

Vulnerability Analysis

This vulnerability is classified as Insufficiently Protected Credentials (CWE-522), representing a significant information disclosure risk within Azure AD environments. The core issue stems from how Azure AD handled private key data when uploaded as part of authentication certificate keyCredential configurations on Applications or Service Principals.

When organizations configure certificate-based authentication for Azure AD Applications, they may inadvertently upload the private key portion alongside the public certificate. Prior to Microsoft's remediation, this private key data was accessible to any principal within the tenant that possessed application read permissions—a common privilege in enterprise Azure environments.

The vulnerability is exploitable over the network without user interaction, requiring only low-privileged access (application read permissions) within the affected tenant. While it does not enable direct code execution or data modification, the confidentiality impact is significant as exposed private keys could be used to impersonate applications and access protected resources.

Root Cause

The root cause lies in Azure AD's insufficient protection of private key material stored within keyCredential objects. When applications or automation processes uploaded certificate credentials containing private keys, the platform failed to properly redact or encrypt this sensitive data from principals with read access. This design oversight allowed the private key values to be read by any tenant user or service with standard application read permissions, violating the principle of least privilege for cryptographic material.

Attack Vector

An attacker with legitimate application read access within an Azure AD tenant could enumerate Applications and Service Principals to identify those configured with certificate-based authentication. By querying the keyCredential properties of these objects, the attacker could extract unprotected private key data. With the obtained private keys, the attacker could then authenticate as the compromised application or service principal, gaining access to any resources that application was authorized to access.

The attack requires network access and authenticated access to the Azure AD tenant with application read permissions. Services potentially affected include Azure Automation Run As accounts, Azure Migrate, Azure Site Recovery, and any custom applications that uploaded certificates with embedded private keys.

Detection Methods for CVE-2021-42306

Indicators of Compromise

• Unusual queries to Microsoft Graph API for application or service principal keyCredential properties
• Unexpected authentication events from service principals using certificate-based authentication
• Access to sensitive resources from unfamiliar IP addresses using compromised application identities
• Enumeration patterns in Azure AD audit logs showing bulk queries for application configurations

Detection Strategies

• Monitor Azure AD audit logs for excessive Application.Read.All or Directory.Read.All permission usage
• Implement alerts for unusual Microsoft Graph API query patterns targeting keyCredential objects
• Review sign-in logs for service principals authenticating from unexpected locations or client applications
• Audit applications with certificate credentials to identify any that may have contained private keys

Monitoring Recommendations

• Enable and centralize Azure AD audit logging for application and service principal access
• Configure Azure Sentinel or equivalent SIEM to detect anomalous application enumeration behavior
• Implement conditional access policies for service principals where supported
• Regularly review and rotate credentials for Azure Automation, Migrate, and Site Recovery components

How to Mitigate CVE-2021-42306

Immediate Actions Required

• Review all Azure AD Applications and Service Principals for certificate credentials that may contain private keys
• Rotate any potentially exposed certificates and their associated credentials
• Audit Azure Automation Run As accounts, Azure Migrate, and Azure Site Recovery configurations
• Review tenant audit logs for signs of credential enumeration or unauthorized access

Patch Information

Microsoft has addressed this vulnerability at the platform level by preventing disclosure of any private key values added to applications. No customer action is required to receive this platform-level fix. However, organizations should still review their environments for potentially exposed credentials.

For detailed remediation guidance and affected service-specific instructions, refer to the Microsoft Security Advisory CVE-2021-42306.

Workarounds

• Implement strict access controls limiting which principals have application read permissions in the tenant
• Use Azure Key Vault to store and manage certificates instead of uploading them directly to Azure AD
• Adopt managed identities where possible to eliminate the need for certificate-based authentication
• Implement just-in-time access for administrative operations that require application read permissions

# Azure CLI: Review applications with key credentials
az ad app list --query "[?keyCredentials!=null].{AppId:appId, DisplayName:displayName, KeyCredentials:keyCredentials}" --output table

# PowerShell: Identify service principals with key credentials
Get-AzADServicePrincipal | Where-Object { $_.KeyCredentials.Count -gt 0 } | Select-Object DisplayName, Id, KeyCredentials