Azure's Weakest Link – Five Full Cross-Tenant Compromises

(binarysecurity.no)

120 points | by swq115 4 hours ago

5 comments

  • albert_e 58 minutes ago
    maybe we should tag submissions with dates now?

    [2026-10-02]

    beginning of curent month feels like two years ago when multiple vulns drop daily

  • meekins 1 hour ago
    When it comes to the amount of cross-tenant leaks Azure looks to be way ahead the competition. Makes me wonder why enterprises still flock there.
    • traceroute66 37 minutes ago
      > Makes me wonder why enterprises still flock there

      Well, when you're already paying Microsoft $/user/month for Intune, Teams&co. you might as well use Azure too.

      Only one vendor relationship to manage, and I suspect you probably have to spend far less money than you do with AWS to get some personal attention.

    • xmcp123 57 minutes ago
      Same reason as it was in 2002. “No one ever got fired for buying Microsoft.”
      • Betelbuddy 17 minutes ago
        Lets get our Cloud...from the same guys who have been unable to provide a freeze screen feature in Teams for 10 years..should be a firing offense...
        • totallykvothe 2 minutes ago
          Wdym? Teams freezes my screen all the time!
  • thewisenerd 1 hour ago
    path traversal and IDOR..

    likely been active since the inception of these capabilities

    wonder if the recommendation to "add randomness to resource names" is because of this (unrelated security by obscurity lol)

    • chinathrow 1 hour ago
      Gotta put these backdoors somewhere.
  • xmcp123 1 hour ago
    God. I would hate to be the engineer forced to have enough Azure experience to be able to find these bugs and understand Azure’s infrastructure on this level.

    Should have been addressed in the Geneva conventions.

  • eugenekay 43 minutes ago
    Reporting cross-Tenant issues as an outsider with a vulnerability chain gets you $$$.

    Reporting “theoretical” issues with validation as an Employee gets you a lot of questions as to why you were looking.

    Oh well.

    • traceroute66 33 minutes ago
      > Reporting “theoretical” issues with validation as an Employee

      Microsoft still has employees ? ;)

      (Sorry. Low bar. But in all honesty I thought they outsourced the majority of ops. I was surprised to hear in recent news that they actually had that many employees left)