Microsoft Defender reports attack paths from Azure TRE Web Apps to Key Vaults

[Ansar Rafique (ansarrafique)]

We are running Azure TRE v0.27.0 and use Microsoft Defender for Cloud to monitor the environment. Defender is currently reporting three attack paths involving Azure TRE Web Apps, managed identities, and Key Vaults:

• 1 Critical
• 2 High

The critical finding is:

Internet exposed Azure Web App with high severity vulnerabilities allows lateral movement to Critical Azure Key Vault

The other two high findings are:

Internet exposed Azure Web App with high severity vulnerabilities allows lateral movement to Azure Key Vault

The attack path in each case is like:

Internet → Azure Web App → Managed Identity → Azure Key Vault

From what I understand, Defender is highlighting that if the internet-facing Web App is compromised, its managed identity could potentially be used to access the associated Key Vault.

I wanted to check whether others are seeing the same findings and how these should be handled.

I have a few questions:

1. Am I understanding this finding correctly, and is this something I should be concerned about?
2. Have any of these vulnerability findings been addressed in newer Azure TRE releases?
3. Are these the sort of issues that should be addressed upstream in Azure TRE, or are individual deployments expected to handle them?
4. If they need to be addressed locally, is there a recommended way to do this without making it difficult to upgrade Azure TRE later?

I would be interested to hear how others are approaching these findings before making changes locally.

[Jack Morris (rudolphjacksonm)]

Hi Ansar,

Similar to Daniel's reply and mine on #5042 and #5040 , is it possible for you to upgrade your deployment to 0.28.0 to see if that resolves some of these findings?

[Ansar Rafique (ansarrafique)]

Hi Jack,

Thank you for your reply. Absolutely, we are considering to upgrade our deployment to v0.28.0 to see if that resolves the findings. However, according to your reply on #5040 , you are releasing v0.29.0 soon. Do you have any idea when this is expected? If it's coming out soon, perhaps we should wait and upgrade to v0.29.0 instead?

[Jack Morris (rudolphjacksonm)]

I would recommend upgrading to 0.28.0 first. 0.29.0 should be imminent after testing concludes, but I'd have to do some research to see if you could skip 0.28.0 altogether. Marcus Robinson (@marrobi) thoughts?