Azure Guest Agent Design Enables Plaintext Password Theft

Researchers from Guardicore found that attackers can abuse the Microsoft Azure Guest Agent’s design to recover plaintext administrator passwords from target machines.  This flaw can be abused on any Azure machine, Windows or Linux, where the Azure reset password tool was used.  Microsoft recommends customers follow Azure security best practices to protect against this attack.  Azure users are also urged to check if they have reset password configuration files stored on their Azure machines and if so, delete them.

Relevant URL(s):