Security vulnerability for Arc VMs running on Azure Local, version 23H2

Description

Microsoft has identified a security vulnerability that could expose the local admin credentials used during the creation of Arc VMs on Azure Local to non-admin users on the VM and on the hosts.

Affected releases

Arc VMs created on releases prior to Azure Local 2411 release are vulnerable.

Mitigation and ongoing protection

To mitigate this risk, we recommend that you take 2 actions:

• Update Azure Local resources to version 2411. See the instructions on how to Update.
• Rotate the administrator passwords (set during VM creation) for all Azure Arc VMs deployed prior to updating the Azure Local instance to version 2411. See the instructions on how to update these passwords:
  • Identify Arc VMs
  • Change local account passwords

Identify Arc VMs

1. Run the following script to identify all the Arc VMs created before the Azure Local 2411 release. Make sure to change the variables in the beginning of the script with the appropriate values and run it in Administrative context.
2. Before starting make sure to install Az CLI using the instructions in https://learn.microsoft.com/cli/azure/install-azure-cli and restart PowerShell

# Install necessary modules and set execution policy
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned
Install-Module -Name Az.Resources

# Variables
$resourceGroup="Name of your resource group”
$clusterName="Name of the cluster"
$tenantID="GUID of the Azure Tenant"
$subscriptionID="GUID of the Azure Subscription"

# Disconnect from existing AzAccount and login to the Azure Tenant
Disconnect-AzAccount
Connect-Azaccount -DeviceCode -Tenant $tenantID -Subscription $subscriptionID

# Login to the Azure Tenant
az login --tenant $tenantID

# Get the update date of the cluster 
$install_date=Get-AzResource -ResourceId "/subscriptions/$subscriptionID/resourceGroups/$resourceGroup/providers/microsoft.azurestackhci/clusters/$clusterName/updates/Solution10.2411.0.22" -ExpandProperties

# Get the list of VMs and their creation dates
az config set extension.dynamic_install_allow_preview=true
$vms=az stack-hci-vm list --resource-group $resourceGroup | ConvertFrom-json

# Format the table and flag VMs that are updated before the update date
$results = @()
foreach($vm in $vms) {
   $condition = [datetime]$vm.properties.systemData.createdAt -le $install_date.properties.installedDate
   $results += [PSCustomObject]@{
       VMName                      = $vm.Name
       CreationDate                = [datetime]$vm.properties.systemData.createdAt
       ClusterUpdateDate           = $install_date.properties.installedDate
       CredentialUpdateRequired    = $condition
   }
}
$results | Format-Table -AutoSize
        

Change local account passwords

Arc VM creation generates two local administrator accounts:

• Local administrator account 1

  • Name: administrator (automatically created name)
  • Password: Randomly generated password

• Local administrator account 2

  • Name: User provided name
  • Password: User provided password

[!NOTE] We recommend changing the passwords for both local administrator accounts.

Once the Arc VMs are identified, follow these steps to change the local account passwords.

The steps are different for Windows and Linux VMs.

Windows VMs

For Windows VMs, follow these steps:

1. Sign in to the Arc VM.

2. Run the following PowerShell script. This script will help you change the passwords for both the accounts.

   Make sure to change the $username variable with the account name provided during Arc VM creation.

   # Define the username
   $username = "AccountName"
   
   # Prompt the user to enter the new password securely
   $newPassword = Read-Host -AsSecureString "Enter the new password for $username"
   
   # Prompt the user to re-enter the new password securely for verification
   $verifyPassword = Read-Host -AsSecureString "Re-enter the new password for verification"
   
   # Convert the secure strings to plain text for comparison
   $plainPassword = [Runtime.InteropServices.Marshal]::PtrToStringAuto([Runtime.InteropServices.Marshal]::SecureStringToBSTR($newPassword))
   $plainVerifyPassword = [Runtime.InteropServices.Marshal]::PtrToStringAuto([Runtime.InteropServices.Marshal]::SecureStringToBSTR($verifyPassword))
   
   # Check if the passwords match and change the password if they match. Fail if the passwords don’t match.
   if ($plainPassword -ceq $plainVerifyPassword) {
      $account = [ADSI]"WinNT://./$username,user"
      $account.SetPassword($plainPassword)
      $account.SetInfo()
    
      $account = [ADSI]"WinNT://./administrator,user"
      $account.SetPassword($plainPassword)
      $account.SetInfo()
   
       Write-Host "Password for user $username has been reset successfully." -ForegroundColor Green
   } else {
       Write-Host "The passwords do not match. Please try again." -ForegroundColor Red
   }    
   

Linux VMs

For Linux VMs, follow these steps:

1. Sign in to the Arc VM.

2. Run the following script from where Bash is installed:

   If Bash is located in a different directory, make sure to change this line #!/bin/bash accordingly.

   #!/bin/bash
   
   # Define the username
   username="AccountName"
   
   # Prompt the user to enter the new password securely
   echo -n "Enter the new password for $username: "
   read -s newPassword
   echo
   
   # Prompt the user to re-enter the new password securely for verification
   echo -n "Re-enter the new password for verification: "
   read -s verifyPassword
   echo
   
   # Check if the passwords match
   if [ "$newPassword" == "$verifyPassword" ]; then
       # Reset the password for the local account
       echo "$username:$newPassword" | sudo chpasswd
       echo -e "\e[32mPassword for user $username has been reset successfully.\e[0m"
   else
       echo -e "\e[31mThe passwords do not match. Please try again.\e[0m"
   fi