CVE-2023-36019: Azure Logic Apps Spoofing Vulnerability

CVE-2023-36019 Overview

CVE-2023-36019 is a spoofing vulnerability affecting Microsoft Power Platform Connector and Azure Logic Apps. This vulnerability allows attackers to manipulate connector behavior through external file path control, potentially enabling malicious actors to redirect users to attacker-controlled resources or inject malicious content through spoofed connectors. The vulnerability stems from improper external control of file names or paths (CWE-73), which can be exploited to manipulate how the Power Platform processes external resources.

Critical Impact

Attackers can exploit this spoofing vulnerability to deceive users through manipulated Power Platform connectors, potentially leading to credential theft, unauthorized data access, or further compromise of connected enterprise systems.

Affected Products

• Microsoft Azure Logic Apps
• Microsoft Power Platform

Discovery Timeline

• December 12, 2023 - CVE-2023-36019 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-36019

Vulnerability Analysis

This spoofing vulnerability in Microsoft Power Platform Connector arises from inadequate validation of external file paths and resource references. The weakness classified under CWE-73 (External Control of File Name or Path) indicates that the application allows external input to influence file path resolution without proper sanitization. In the context of Power Platform connectors, this can enable attackers to craft malicious connectors or manipulate existing connector configurations to point to attacker-controlled endpoints.

The attack requires user interaction, meaning a victim must be socially engineered into interacting with a malicious connector or workflow. However, once triggered, the vulnerability can impact resources beyond the security scope of the vulnerable component, potentially affecting other connected services and data sources within the enterprise environment.

Root Cause

The root cause of CVE-2023-36019 lies in improper handling of external file references within the Power Platform Connector architecture. The platform fails to adequately validate and sanitize file paths or resource locations provided through connector configurations. This allows attackers to inject malicious paths that can redirect connector operations to untrusted external resources, effectively spoofing legitimate connector behavior.

Attack Vector

The attack vector for this vulnerability is network-based and requires user interaction. An attacker can exploit this vulnerability by:

1. Creating or modifying a custom connector with malicious file path references
2. Distributing the malicious connector through social engineering or by compromising existing shared connectors
3. When a user interacts with the compromised connector, the spoofed resources are loaded, potentially exposing the user to phishing attacks or data exfiltration

The vulnerability does not require any privileges to exploit, though the attacker needs to convince a user to interact with the malicious connector. The scope is changed, meaning a successful exploit can impact resources beyond the vulnerable component's security boundary.

Detection Methods for CVE-2023-36019

Indicators of Compromise

• Unexpected external URL references in Power Platform connector configurations
• Connectors pointing to non-Microsoft or unauthorized external endpoints
• Unusual authentication prompts appearing within Power Platform workflows
• User reports of unexpected redirects when using custom connectors

Detection Strategies

• Audit Power Platform connector configurations for unexpected external file path references
• Monitor Azure Logic Apps for connections to unauthorized or suspicious external endpoints
• Review connector sharing and distribution logs for anomalous activity
• Implement alerting on new or modified custom connectors within your tenant

Monitoring Recommendations

• Enable comprehensive logging for Power Platform and Azure Logic Apps activities
• Configure Microsoft Defender for Cloud Apps to monitor Power Platform usage
• Set up alerts for connector creation and modification events in the Microsoft 365 compliance center
• Regularly audit the list of custom connectors and their endpoint configurations

How to Mitigate CVE-2023-36019

Immediate Actions Required

• Apply the latest security updates from Microsoft for Power Platform and Azure Logic Apps
• Review and audit all custom connectors currently deployed in your environment
• Restrict custom connector creation to authorized administrators only
• Educate users about the risks of interacting with unknown or unverified connectors

Patch Information

Microsoft has addressed this vulnerability through platform-side updates. Organizations should ensure their Power Platform and Azure Logic Apps environments are receiving automatic updates. For detailed patch information and remediation guidance, refer to the Microsoft Security Response Center advisory for CVE-2023-36019.

Workarounds

• Implement Data Loss Prevention (DLP) policies to restrict connector usage to approved endpoints only
• Use the Power Platform admin center to block or limit custom connector creation
• Configure Azure Logic Apps to only allow connections to whitelisted URLs and services
• Enable tenant isolation settings to prevent connectors from communicating with external tenants

# PowerShell: Review custom connectors in your Power Platform environment
# Run from PowerShell with appropriate admin credentials

# Connect to Power Apps
Connect-PowerApps

# List all custom connectors in the environment
Get-AdminPowerAppConnector -EnvironmentName "Default-<tenant-id>" | 
    Where-Object { $_.Properties.apiDefinitions } |
    Select-Object DisplayName, ConnectorName, CreatedTime