Axis Communications Leaks Azure Credentials in Autodesk Plugin Via Hardcoded SAS Tokens

Axis Communications’ Autodesk Revit plugin exposure stemmed from a signed AzureBlobRestAPI.dll containing hard-coded Azure credentials that granted access to two storage accounts, axisfiles and axiscontentfiles, within Axis’s cloud storage. According to Trend Micro, the credentials were embedded inside the DLL’s internalSetEnvironment method and were valid, allowing control over configuration and read/write access to the storage account artifacts.

The find began when Trend Micro’s automated detection rule flagged a suspicious file on 8 July 2024, and the issue was disclosed after researchers warned of the high risk to thousands of Axis customers. The compromised component, the AXIS Plugin for Autodesk Revit, was distributed with installers and Autodesk model files, creating supply-chain risk for users in sectors such as construction and security.

After ZDI-24-1181 was reported to the Zero Day Initiative, Axis released updates (v25.3.710, followed by v25.3.711 and v25.3.718) that revoked the access keys and replaced them with limited-permission SAS tokens, with Axis confirming there had been no evidence of unauthorized access and that vulnerable versions were removed from cloud storage.