Azure Data Factory Bugs Expose Cloud Infrastructure

Unit 42 found three issues in Azure Data Factory's Apache Airflow integration — a misconfigured Kubernetes RBAC, improper secret handling for the Geneva service, and weak Geneva authentication — that could let an attacker inject malicious DAG files (via writable storage or compromised Git repos) to obtain reverse shells on Airflow workers, leverage a service account to gain cluster admin (shadow admin) privileges, and subsequently exfiltrate data or deploy malware across the Azure environment; Microsoft was informed and the issues were mitigated.