From square root to root - escalating privileges in Azure containers with Python in Excel

The talk starts from a practical question: Excel's Python feature sends user code to a cloud container, so could that code reach Microsoft-owned servers? The researchers begin with basic reconnaissance from a low-privilege account, then map the helper services around the container and reverse-engineer the API the Excel client uses to submit code.

The central finding is in the file upload flow. The service writes uploaded data as root into paths whose names the client can predict and partly control. By placing a symbolic link at the location used for the ETAG output and hiding a payload in the ETAG value, they overwrote a setuid-related binary that a root-level service runs on a schedule, which gave them root. From there they recovered service binaries and a deployment configuration file that exposed internal component names and architecture, reached container hosts across many regions, and found that some images were publicly pullable, including pilot builds. Microsoft responded by checking for symbolic links in file operations.

On the Excel side, the researchers observed that Python workbooks skip the trusted-records prompt that macros trigger. A returned web image object could make the client fetch an arbitrary URL, which could be used to move data back into the isolated container. This led to CVE-2026-45459, covering both the trusted records warning and network isolation. The practical takeaways are to enforce least privilege on anything a service writes as root, and to keep deployment details and skill files off production hosts.