Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Tools/GitHubGitHub/exploreunknowed/cve-2026-24306
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingCloud SecurityRed Teaming
GitHubexploreunknowed/cve-2026-24306

CVE-2026-24306

Proof-of-concept exploit for Azure Front Door privilege escalation (CVE-2026-24306) enabling routing rule injection, backend pool modification, and WAF policy override on misconfigured instances.

View Repository
7 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Azure Front Door Privilege Escalation – CVE-2026-24306 PoC

For authorized red team / research use only. Author not responsible for misuse.

Vulnerability allows:

  • Arbitrary routing rule injection
  • Backend pool / origin group modification
  • WAF policy attachment / override
  • Custom domain takeover on misconfigured AFD instances

Affected: Azure Front Door Standard & Premium tiers (pre-patch builds before 2026-01-22)

Exploitation requires only public endpoint exposure + valid Azure resource ID format. No subscription-level credentials needed in default vulnerable config.

Tested vectors:

  • X-MS-AadUserObjectId / X-MS-Client-Principal-ID header reflection + replay
  • Frontend endpoint ACL evaluation skip via malformed rule priority collision
  • Backend health probe hijack leading to origin manipulation

Usage:

python poc.py --target https://target-frontend.azurefd.net --afd-id /subscriptions/xxxx/resourceGroups/rg/providers/Microsoft.Cdn/profiles/xxxx

Lab setup included (setup-lab.ps1 + Bicep).

Download:

href

Contact: @B1gh0rnn on X (DMs open).

Download Tool