API Management SSRF and path traversal vulnerabilities

Azure API Management is an API gateway service meant to help organizations to create, manage, secure,
and monitor APIs across all of their environments. Researchers found three high severity vulnerabilities
in the service, two of which are SSRF (Server Side Request Forgery) vulnerabilities, and the third is a
path traversal bug. The SSRF flaws affected the Azure API Management CORS proxy (which handles schema
retrieval) and hosting proxy (which routes API requests to the correct server). An attacker successful
in …

api api gateway api management apis azure bug environments forgery gateway high manage management monitor organizations path path traversal request researchers server server side service severity ssrf third vulnerabilities