Azure's Weakest Link – Five Full Cross-Tenant Compromises

(binarysecurity.no)

141 points | by swq115 5 hours ago

6 comments

  • albert_e 1 hour ago
    maybe we should tag submissions with dates now?

    [2026-10-02]

    beginning of curent month feels like two years ago when multiple vulns drop daily

  • meekins 1 hour ago
    When it comes to the amount of cross-tenant leaks Azure looks to be way ahead the competition. Makes me wonder why enterprises still flock there.
    • magicalhippo 19 minutes ago
      For us a big part is that they have data centers in our country. It makes for improved latency and also makes a lot of our customers sleep better (justifiably so or not).

      Amazon doesn't and regardless nobody feels comfortable using Google, who knows when they'll discontinue a product we would rely on.

      So not a lot left to choose from.

    • traceroute66 1 hour ago
      > Makes me wonder why enterprises still flock there

      Well, when you're already paying Microsoft $/user/month for Intune, Teams&co. you might as well use Azure too.

      Only one vendor relationship to manage, and I suspect you probably have to spend far less money than you do with AWS to get some personal attention.

    • xmcp123 1 hour ago
      Same reason as it was in 2002. “No one ever got fired for buying Microsoft.”
      • Betelbuddy 1 hour ago
        Lets get our Cloud...from the same guys who have been unable to provide a freeze screen feature in Teams for 10 years..should be a firing offense...
        • totallykvothe 54 minutes ago
          Wdym? Teams freezes my screen all the time!
    • toomuchtodo 15 minutes ago
      Their sales folks are very good with C level folks, from the meetings I've sat in on. They will give you substantial credits and hands on support to build for you, depending on vertical and predicted future spend, especially if you're already at another cloud provider they're trying to pull you from.
  • thewisenerd 2 hours ago
    path traversal and IDOR..

    likely been active since the inception of these capabilities

    wonder if the recommendation to "add randomness to resource names" is because of this (unrelated security by obscurity lol)

    • chinathrow 1 hour ago
      Gotta put these backdoors somewhere.
  • xmcp123 1 hour ago
    God. I would hate to be the engineer forced to have enough Azure experience to be able to find these bugs and understand Azure’s infrastructure on this level.

    Should have been addressed in the Geneva conventions.

  • eugenekay 1 hour ago
    Reporting cross-Tenant issues as an outsider with a vulnerability chain gets you $$$.

    Reporting “theoretical” issues with validation as an Employee gets you a lot of questions as to why you were looking.

    Oh well.

    • outworlder 2 minutes ago
      So MSFT discourage employees from reporting vulnerabilities?

      That explains a lot.

    • traceroute66 1 hour ago
      > Reporting “theoretical” issues with validation as an Employee

      Microsoft still has employees ? ;)

      (Sorry. Low bar. But in all honesty I thought they outsourced the majority of ops. I was surprised to hear in recent news that they actually had that many employees left)

  • klorbrinnbor 39 minutes ago
    [flagged]