Axis Communications Vulnerability Exposes Azure Storage Credentials
Axis Communications, a provider of network video and surveillance solutions, has addressed a critical vulnerability in its Autodesk® Revit® plugin. The issue involved the exposure of Azure Storage Account credentials within signed DLLs.
Axis Communications, a provider of network video and surveillance solutions, has addressed a critical vulnerability in its Autodesk® Revit® plugin. The issue involved the exposure of Azure Storage Account credentials within signed DLLs.
In July 2024, Trend Micro's Zero Day Initiative™ discovered a vulnerability that enabled attackers to access and manipulate cloud assets belonging to Axis and its customers. The vulnerability involved a digitally signed DLL, AzureBlobRestAPI.dll, included in the AXIS Plugin for Autodesk Revit. This DLL, signed by AEC Advanced Engineering Computation AB, contained cleartext Azure Shared Access Signature (SAS) tokens and access key pairs for storage accounts named “axisfiles” and “axiscontentfiles.”
The embedded credentials allowed users with the plugin to control these accounts, including reading, writing, and modifying stored resources. The storage accounts hosted MSI installers for the Revit plugin and proprietary RFA model files for Axis products.
Following disclosure under advisory ZDI-24-1181, Axis released version 25.3.710 of the plugin, which obscured credentials via .NET obfuscation. However, tools like de4dot could still recover the SAS tokens and access keys, leading to advisories ZDI-24-1328 and ZDI-24-1329. Axis then issued version 25.3.711, removing the storage account access keys and embedding a read-only SAS token for a new account.
Axis Communications, a provider of network video and surveillance solutions, has addressed a critical vulnerability in its Autodesk® Revit® plugin.
The final advisory, ZDI-25-858, prompted Axis to revoke the original storage account keys and publish version 25.3.718 in March 2025. This update eliminated embedded credentials and enforced least-privilege access, ensuring that only authorized customers could download plugin assets and model files. Axis also removed all vulnerable plugin versions and notified affected partners to upgrade.
Beyond credential leaks, potential repercussions of compromised RFA files were examined. Revit family files serve as input for 3D modeling and have been prone to parser vulnerabilities. Several vulnerabilities in Revit's RFA handling could enable remote code execution if an attacker replaced legitimate model files with malicious variants hosted on Axis's storage accounts.
This incident underscores the importance of continuous security review of third-party plugins, adherence to the principle of least privilege for cloud credentials, and rigorous file-format parsing safeguards. Organizations using cloud distribution mechanisms and third-party extensions should validate trust, implement robust secret management, and monitor for anomalies to prevent supply chain exploits.
Based on reporting by GBHackers.