# CVE-2026-42826 — Detailed Usage Guide

## Table of Contents

1. [Vulnerability Overview](#vulnerability-overview)
2. [Technical Analysis](#technical-analysis)
3. [Prerequisites](#prerequisites)
4. [Installation](#installation)
5. [Quick Start (Unauthenticated Scan)](#quick-start-unauthenticated-scan)
6. [Full Exploitation (With PAT)](#full-exploitation-with-pat)
7. [On-Premises Azure DevOps Server](#on-premises-azure-devops-server)
8. [Detection & Hardening Checker](#detection--hardening-checker)
9. [Attack Phases Explained](#attack-phases-explained)
10. [Secret Scanner Patterns](#secret-scanner-patterns)
11. [Report Format](#report-format)
12. [Testing & Validation](#testing--validation)
13. [Mitigation & Remediation](#mitigation--remediation)
14. [Troubleshooting](#troubleshooting)

---

## Vulnerability Overview

| Field | Value |
|-------|-------|
| **CVE ID** | CVE-2026-42826 |
| **CVSS (Microsoft)** | 10.0 Critical — AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| **CVSS (NVD)** | 7.5 High — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| **CWE** | CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) |
| **GHSA** | [GHSA-gmwx-3xm2-9fx8](https://github.com/advisories/GHSA-gmwx-3xm2-9fx8) |
| **Affected Products** | Azure DevOps Services, Azure DevOps Server 2022/2025 |
| **Patched** | Azure DevOps Server 2026.0.1+ (Services patched server-side) |
| **Discoverer** | Noa Royzman (Microsoft) |
| **Published** | May 7, 2026 |

Azure DevOps exposes sensitive information to unauthorized actors over a network. The vulnerability allows an unauthenticated, remote attacker to disclose information with no user interaction required. The impact extends beyond the Azure DevOps component itself (Scope: Changed), potentially affecting connected services and infrastructure.

---

## Technical Analysis

### Vulnerability Class

This is an **information disclosure** vulnerability (CWE-200), not a code execution or injection vulnerability. The exploit extracts data that should be protected but is accessible due to:

1. **Public project visibility** — Projects set to "public" expose all data to unauthenticated users
2. **Authentication bypass** — Specific internal API endpoints fail to enforce auth checks
3. **Overly permissive PATs** — Full-access PATs with long expiry amplify exposure

### Attack Surface

The Azure DevOps REST API surface includes endpoints for:

| Endpoint | Data Exposed |
|----------|-------------|
| `/_apis/projects` | Project names, descriptions, visibility |
| `/{project}/_apis/pipelines` | Pipeline names, folders, configurations |
| `/{project}/_apis/distributedtask/variablegroups` | Variable group names, non-secret values |
| `/{project}/_apis/serviceendpoint/endpoints` | Service connection names, types, Azure subscription IDs |
| `/{project}/_apis/git/repositories` | Repository names, branches, sizes |
| `/{project}/_apis/build/builds/{id}/logs` | Build log fragments with potential secrets |
| `/{project}/_apis/git/repositories/{repo}/items` | File contents (including pipeline YAML) |

### Why It Works

1. **Public projects**: Azure DevOps allows projects to be set to "public" visibility. Any team member can set a project to public if the org policy allows it. Public projects expose repos, pipelines, artifacts, and work items to the unauthenticated internet.

2. **Authentication bypass**: The CVE specifically addresses a condition where an internal API endpoint fails to enforce authentication checks before returning data. This means even private project data may be accessible.

3. **Non-secret variables**: Variables in variable groups that are not marked as "secret" are visible in the UI, returned by the API in plaintext, and printed to build logs. A read-only attacker can harvest them without triggering alerts.

---

## Prerequisites

- **Python 3.6+** (uses only standard library — no pip install needed)
- Network access to target Azure DevOps instance
- Optional: Personal Access Token (PAT) for authenticated exploitation

---

## Installation

```bash
# Clone the repository
git clone https://github.com/sam00/POC-CVE-2026-42826-Azure-DevOps-Info-Disclosure.git
cd POC-CVE-2026-42826-Azure-DevOps-Info-Disclosure

# No dependencies to install — pure Python standard library
```

---

## Quick Start (Unauthenticated Scan)

Check if an Azure DevOps organization has publicly exposed projects:

```bash
python3 exploit.py -u https://dev.azure.com/targetorg
```

This will:
1. Attempt to access the projects API without authentication
2. Identify any projects with "public" visibility
3. Report exposed project names and descriptions
4. Generate a summary of findings

**Expected output (vulnerable):**
```
[12:00:00] [BOLD] Phase 0: Checking public project exposure...
[12:00:00] [VULN] VULNERABLE: 3 public project(s) found!
[12:00:00] [VULN] Unauthenticated access to project data is possible.
[12:00:00] [VULN]   PUBLIC: MyProject — A public project
```

**Expected output (not vulnerable):**
```
[12:00:00] [INFO] Organization requires authentication (no public access)
```

---

## Full Exploitation (With PAT)

### Step 1: Create a PAT (if needed)

1. Go to Azure DevOps → User Settings → Personal Access Tokens
2. Create a token with appropriate scopes:
   - `Project: Read` — for project enumeration
   - `Pipeline: Read` — for pipeline configs
   - `Variable Groups: Read` — for variable group data
   - `Service Connections: Read` — for service connection metadata
   - `Code: Read` — for repository access
3. Copy the token

### Step 2: Run the exploit

```bash
# Full exploitation
python3 exploit.py -u https://dev.azure.com/targetorg --pat YOUR_PAT_TOKEN

# Target specific project only
python3 exploit.py -u https://dev.azure.com/targetorg --pat YOUR_PAT --project MyProject

# Save report to JSON file
python3 exploit.py -u https://dev.azure.com/targetorg --pat YOUR_PAT -o report.json

# Enable debug output
python3 exploit.py -u https://dev.azure.com/targetorg --pat YOUR_PAT --debug
```

### Step 3: Review the report

The exploit runs through 6 phases:
1. **Phase 0**: Check public project exposure
2. **Phase 1**: Enumerate all accessible projects
3. **Phase 2**: Extract pipeline configurations (YAML)
4. **Phase 3**: Harvest variable group metadata
5. **Phase 4**: Extract service connection identifiers
6. **Phase 5**: Enumerate repositories and extract pipeline files

---

## On-Premises Azure DevOps Server

```bash
# Azure DevOps Server (TFS) on-premises
python3 exploit.py -u https://tfs.company.local/tfs/DefaultCollection --pat YOUR_PAT

# With specific API version
python3 exploit.py -u https://tfs.company.local/tfs/DefaultCollection --pat YOUR_PAT --api-version 6.0
```

---

## Detection & Hardening Checker

Run the detection checker to assess your Azure DevOps instance:

```bash
python3 detect.py -u https://dev.azure.com/yourorg --pat YOUR_PAT
```

Checks performed:
1. **Unauthenticated API access** — Can projects be accessed without auth?
2. **Public project visibility** — Are any projects set to public?
3. **Organization policy** — Does the org allow public projects?
4. **Variable group secrets** — Are non-secret variables storing sensitive values?
5. **Service connection exposure** — Are service connections set to "Allow all pipelines"?

---

## Attack Phases Explained

### Phase 0: Public Exposure Check

Sends an unauthenticated GET request to `/_apis/projects`. If the API returns 200 with project data, the organization has public projects enabled. Projects with `visibility: "public"` are immediately flagged as critical findings.

### Phase 1: Project Enumeration

Enumerates all accessible projects using `/_apis/projects`. For each project, extracts:
- Project ID, name, description
- Visibility (public/private)
- State and revision

### Phase 2: Pipeline Configuration Extraction

For each project, queries `/{project}/_apis/pipelines` to get pipeline metadata. Then attempts to extract YAML configurations by:
- Querying pipeline configuration endpoints
- Searching repositories for `azure-pipelines.yml` files
- Scanning extracted YAML for sensitive patterns (subscription refs, connection names)

### Phase 3: Variable Group Harvesting

Queries `/{project}/_apis/distributedtask/variablegroups` to extract:
- Variable group names and descriptions
- All variable names
- Non-secret variable **values** (in plaintext)
- Secret variable names (values masked as `***MASKED***`)

### Phase 4: Service Connection Extraction

Queries `/{project}/_apis/serviceendpoint/endpoints` to extract:
- Service connection names and types
- Azure subscription IDs and names
- Tenant IDs
- Kubernetes cluster IDs
- Docker registry URLs
- Resource group names

### Phase 5: Repository Enumeration

Queries `/{project}/_apis/git/repositories` to list all repositories. For each repo, attempts to extract pipeline YAML files from common paths:
- `azure-pipelines.yml`
- `azure-pipelines.yaml`
- `.azure-pipelines/azure-pipelines.yml`
- `pipelines/azure-pipelines.yml`
- `.azure/pipelines.yml`

### Phase 6: Build Log Extraction

For recent builds, queries `/{project}/_apis/build/builds/{id}/logs` to extract log fragments. Scans logs for:
- Environment variables
- Connection strings
- API keys
- Subscription references

---

## Secret Scanner Patterns

The exploit includes a built-in secret scanner that detects:

| Pattern | Description |
|---------|-------------|
| `azureSubscription: ...` | Azure subscription reference in YAML |
| `kubernetesServiceConnection: ...` | Kubernetes service connection |
| `dockerRegistryServiceConnection: ...` | Docker registry connection |
| `ARM_CLIENT_ID` | Azure ARM client ID |
| `ARM_TENANT_ID` | Azure ARM tenant ID |
| `ARM_SUBSCRIPTION_ID` | Azure ARM subscription ID |
| `AZURE_DEVOPS_PAT` | Azure DevOps PAT reference |
| `SYSTEM_ACCESSTOKEN` | System access token reference |
| `AKIA[0-9A-Z]{16}` | AWS access key |
| `ghp_/gho_/ghu_/ghs_/ghr_...` | GitHub tokens |
| `eyJ...eyJ...` | JWT tokens |
| `user@email.com` | Email addresses |

---

## Report Format

The exploit generates a JSON report with the following structure:

```json
{
  "cve": "CVE-2026-42826",
  "cvss": "10.0 Critical",
  "cwe": "CWE-200",
  "target": "https://dev.azure.com/targetorg",
  "timestamp": "2026-08-03T12:00:00",
  "authenticated": true,
  "findings": [
    {
      "type": "public_project_exposure",
      "severity": "CRITICAL",
      "count": 3,
      "projects": ["ProjectA", "ProjectB", "ProjectC"]
    }
  ],
  "summary": {
    "projects": 5,
    "pipelines": 12,
    "variable_groups": 8,
    "service_connections": 4,
    "repositories": 15,
    "build_logs": 20,
    "sensitive_data_points": 7
  },
  "extracted_data": {
    "projects": [...],
    "pipelines": [...],
    "variable_groups": [...],
    "service_connections": [...],
    "repositories": [...],
    "build_logs": [...],
    "sensitive_data": [...]
  }
}
```

---

## Testing & Validation

### Unit Tests

```bash
python3 test_exploit.py
```

Tests cover:
- Exploit initialization and configuration
- API URL construction
- Secret scanner pattern detection (AWS keys, GitHub tokens, JWT, Azure refs)
- Report generation and file saving
- Mocked API requests (200, 401 responses)
- Project enumeration with mocked data
- Variable group harvesting with mocked data
- Service connection extraction with mocked data
- Public exposure detection
- No-false-positive verification

---

## Mitigation & Remediation

### Immediate Actions

1. **Set all projects to private**:
   - Project Settings → Visibility → Private
   - Audit all projects for public visibility

2. **Block public projects at org level**:
   - Organization Settings → Policies → Turn off "Allow public projects"

3. **Mark all sensitive variables as secret**:
   - Variable groups → Edit each variable → Check "Keep value secret"

4. **Restrict service connections**:
   - Service connections → Edit → Uncheck "Allow all pipelines to use this connection"

### Ongoing Hardening

5. **Use scoped PATs**:
   - Create PATs with minimal required scope
   - Set 90-day maximum expiry
   - Never commit PATs to repositories

6. **Scan build logs for secrets**:
   - Implement pre-build secret scanning
   - Use Azure Key Vault for all secrets
   - Configure log redaction

7. **Monitor API access**:
   - Enable Azure DevOps audit logging
   - Alert on unauthenticated API access attempts
   - Monitor for anomalous request patterns

8. **Apply security updates**:
   - Azure DevOps Server: Update to 2026.0.1+
   - Azure DevOps Services: Automatically patched by Microsoft

---

## Troubleshooting

| Issue | Solution |
|-------|----------|
| `401 Unauthorized` | Organization requires auth — provide PAT with `--pat` |
| `404 Not Found` | Check organization URL — ensure correct path for on-prem |
| `SSL certificate error` | For on-prem with self-signed certs, use `--timeout` to adjust |
| `Connection timeout` | Increase timeout with `--timeout 30` |
| `No projects found` | PAT may lack `Project: Read` scope |
| `No pipelines found` | PAT may lack `Pipeline: Read` scope |
| `No variable groups` | PAT may lack `Variable Groups: Read` scope |
| `No service connections` | PAT may lack `Service Connections: Read` scope |