Azure cross-tenant flaws show the limits of input filtering

Azure API Connections manage backend authentication by having Azure Resource Manager route requests through a shared API Management proxy, which exchanges caller tokens for configured credentials targeting backends like Key Vault and SQL. In a research report documenting five cross-tenant compromises, Binary Security demonstrated how this architecture allowed an attacker to reach foreign customer environments.

The initial attack relied on standard path traversal in the DynamicInvoke endpoint to prompt the proxy to release tokens for resources in other subscriptions. After Microsoft placed path checks on that specific route, the researcher inspected binaries from a dedicated Logic App host and identified undocumented sister functions like DynamicList. Because the backend proxy retained global access across all customer connections, querying those alternative endpoints with directory traversal parameters bypassed the blacklist and enabled arbitrary SQL queries against another tenant's database.

Filtering path strings on individual endpoints does not solve the root issue when an internal proxy retains ambient permission to fetch credentials for any tenant. If the proxy cannot cryptographically verify that the caller owns the target connection before minting a token, every newly exposed management path reopens the compromise. For teams relying on managed cloud connectors, it is a reminder that vendor-managed plumbing often trades structural isolation for integration convenience.