Axis Communications Vulnerability Exposes Azure Storage Credentials

Axis Communications disclosed a critical vulnerability in its Autodesk Revit plugin that exposed Azure Storage Account credentials within signed DLLs, allowing attackers to read, write and modify stored resources. Discovered in July 2024 by Trend Micro’s Zero Day Initiative™, the AzureBlobRestAPI.dll was bundled in the AXIS Plugin for Autodesk Revit and signed by AEC Advanced Engineering Computation AB, an Axis partner.

The DLL contained cleartext Azure Shared Access Signature tokens and access key pairs for two storage accounts named “axisfiles” and “axiscontentfiles,” and embedding valid credentials in a private method meant that any user with the plugin could access those accounts. Following disclosure under advisory ZDI-24-1181, Axis released version 25.3.710 to obscure credentials via .NET obfuscation, but tools such as de4dot could still recover the tokens, prompting further advisories ZDI-24-1328 and ZDI-24-1329.

Axis subsequently issued version 25.3.711 to remove storage account keys and embed a read-only SAS token, and finally, after ZDI-25-858, published version 25.3.718 in March 2025 to revoke the original keys and enforce least-privilege access. The incident underscored supply‑chain risks, as compromised installers and RFA model files could be downloaded or tampered with, and Axis has since removed vulnerable plugin versions and urged customers to upgrade.