H3-2026-0060¶

Azure App Service Code Execution via Kudu API

Description¶

Azure App Services expose a Kudu SCM API (https://.scm.azurewebsites.net) that allows authenticated callers to execute arbitrary commands inside the App Service sandbox. When SCM basic authentication is enabled, publishing credentials (retrievable via the ARM publishingcredentials/list API or from a compromised Azure credential) can be used to run commands without network restrictions, query the managed identity endpoint for ARM and Graph tokens, and harvest application secrets such as app settings and connection strings.

Impact¶

Attackers with Azure management API credentials or publishing credentials can execute arbitrary commands in the App Service container, steal managed identity tokens to move laterally across Azure resources, and exfiltrate application secrets including database connection strings and API keys stored as app settings.

References¶

• Azure App Service Kudu documentation
• MITRE ATT&CK Technique: T1059: Command and Scripting Interpreter
• MITRE ATT&CK Technique: T1078.004: Valid Accounts: Cloud Accounts