EmojiDeploy

Multiple Azure Web services use a source control management (SCM) panel powered by Kudu and
enabled by default. These services were all susceptible to a CSRF vulnerability due to an
overly-permissive regular expression (regex) in a filter for malformed origins. This allowed
origin bypass when using a domain name structured as 'victim.scm.azurewebsites.net._.attacker.com'
(note the use of '._.', which looks like an emoji). Thus, if a target Azure user were tricked
into visiting a specially crafted webpage served by a domain …

azure bypass control csrf default domain domain name emoji emojideploy filter malformed management name .net origin panel regex regular expression scm services target victim vulnerability web web services