Azure’s Weakest Link - Five Full Cross-Tenant Compromises
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
A security researcher reports five cross-tenant compromise vulnerabilities in Azure API Connections, part of Azure Logic Apps, earning $200,000 in bounties. The flaws let an attacker route requests through ARM to another tenant's stored connection credentials, reaching backends such as Key Vaults, Azure SQL databases, and external services like Jira…