# EmojiDeploy: Smile! Your Azure web service just got RCE’d ._.

Kudu SCM on Azure web services had SameSite=None cookies and a bypassable origin regex, enabling CSRF zipdeploy of a webshell for RCE.

- Payout: $30,000
- Severity: critical
- Program: Microsoft
- Credited: Liv Matan
- Disclosed: 2023-01-19
- Write-up quality: 8/10
- Original: https://ermetic.com/blog/azure/emojideploy-smile-your-azure-web-service-just-got-rced/
- Library page: https://bugbountylibrary.com/r/blog%3Aermetic-com-blog-azure-emojideploy-smile-your-azure-web-service-just-got-rced
- Tags: domain:cloud impact:internal-access impact:rce kind:bounty platform:blog sev:critical tech:azure technique:chained technique:source-review vuln:csrf vuln:misconfiguration vuln:rce

**Target:** Kudu SCM panel (/api/zipdeploy) on Azure App Service/Function/Logic Apps
**Root cause:** SCM session cookies set SameSite=None and the server origin check used a regex that accepted special characters (e.g. '.') before an attacker-controlled domain, so cross-origin requests were trusted.
**Steps:**
1. Create wildcard DNS `*.attacker.com` pointing to attacker server.
2. Build malicious ZIP containing ASPX webshell.
3. POST to `https://victim.scm.azurewebsites.net/api/zipdeploy?isAsync=true` with `Content-Type: text/plain` and zip bytes as body, `withCredentials=true`.
4. Lure victim to page whose origin is `https://victim.scm.azurewebsites.net._.attacker.com/` to satisfy origin regex.
5. Optionally `window.open` SCM panel first to auto-auth via Microsoft account cookies.
6. Access deployed webshell to run commands as www user.
**How found:** Noticed all SCM cookies set SameSite=None, hypothesized further cross-site issues; probed origin check with Burp/Postman and found special chars like `$` bypassed the regex; then searched Kudu source/REST docs for endpoints meeting CSRF standard-request conditions (GET/POST, no custom headers, simple MIME), landing on /api/zipdeploy.
**Exploitation:** Victim with SCM or Microsoft account cookies visits attacker page; JS sends credentialed cross-origin POST of a zip payload to /api/zipdeploy; Kudu unpacks it into wwwroot, deploying a webshell for RCE and managed-identity takeover.
**Escalation:** Chained origin-regex bypass + SameSite=None + missing custom-header/Sec-Fetch validation + text/plain acceptance; post-RCE pivot via app managed identity and IMDS token to other Azure services.
**Insight:** When an origin allowlist is regex-based, test special characters (`.`, `$`, `_`) inserted before your domain; also grep SCM/management source for POST endpoints accepting text/plain and not validating custom headers or Sec-Fetch-* — those are CSRF-reachable even when the UI sends X-Requested-With.