Cross-tenant self-service signup bypass in Microsoft Azure API Management

This repository is a small, focused proof-of-concept for abusing Azure API Management developer portal signup when the frontend self-service registration UI is disabled but backend registration endpoints remain exposed. It contains two files: a README describing the vulnerability and post-signup attack chain, and a single Python script, apim_signup.py, which is the exploit entry point. The Python script is interactive and operational rather than a mere detector. It prompts the operator for a target APIM developer portal URL, email, first name, last name, password, and optional HTTP proxy. It then performs three core actions: (1) GETs /v2/captcha-challenge from the target, (2) brute-forces the SHA-256 proof-of-work solution by iterating from 0 to maxnumber and comparing SHA-256(salt+n) to the returned challenge, and (3) POSTs the solved challenge and attacker-controlled signup data to /signup. TLS verification is explicitly disabled, and the script supports routing traffic through a local interception proxy such as Burp or Caido. The exploit capability is account creation on the APIM developer portal despite disabled signup in the UI. The README further documents a likely follow-on path after successful registration: confirm the email, authenticate to the APIM management API with Basic auth, retrieve the internal user ID, self-subscribe to the default Starter product, list subscription secrets, and then call backend APIs through the APIM gateway using the issued subscription key. Those later steps are not automated in the Python script, but they clearly describe the intended impact of the initial signup bypass. There is no evidence this repository belongs to a common exploit framework such as Metasploit or Nuclei. The code is straightforward standalone Python using requests, hashlib, base64, json, time, getpass, and urllib3. Overall, this is a real exploit PoC targeting Microsoft Azure API Management misconfigurations related to exposed signup functionality, with a basic but functional payload that directly creates accounts rather than delivering shellcode or code execution.