Microsoft researchers have recently begun to identify attacks in which the attacker manages to compromise Azure cloud environments, using pivoting techniques from Microsoft SQL servers connected to previously compromised SQL injection vulnerable web applications.

The observed attacks start with the exploitation of a SQL injection vulnerability in a web application in the target’s environment. This allows threat actors to gain access to the MS SQL Server instance hosted in the Azure virtual machine with elevated permissions to execute SQL commands and extract valuable data. If the compromised application has elevated permissions, attackers can trigger the ‘xp_cmdshell’ command to execute operating system (OS) commands via SQL, giving them a direct shell to the host (the virtual machine with the SQL installed).