EmojiDeploy: Smile! Your Azure Web Service Just Got RCE’d ._.

Originally published by Ermetic. Written by Liv Matan. The EmojiDeploy vulnerability is achieved through CSRF (Cross-site request forgery) on the ubiquitous SCM service Kudu. By abusing the vulnerability, attackers can deploy malicious zip files containing a payload to the victim's Azure application.ImpactEmojiDeploy allows remote code execution and a full takeover of the targeted application:Running code and commands as the www userTheft or deletion of sensitive dataPhishing campaignsTakeove...

abusing application attackers azure code code execution cross-site cross-site request forgery csrf deletion emojideploy ermetic files forgery malicious payload rce remote code remote code execution request scm service takeover victim vulnerability web zip