Azure's Weakest Link – Five Full Cross-Tenant Compromises
binarysecurity.no138 points by swq115 5 hours ago
138 points by swq115 5 hours ago
maybe we should tag submissions with dates now?
[2026-10-02]
beginning of curent month feels like two years ago when multiple vulns drop daily
When it comes to the amount of cross-tenant leaks Azure looks to be way ahead the competition. Makes me wonder why enterprises still flock there.
For us a big part is that they have data centers in our country. It makes for improved latency and also makes a lot of our customers sleep better (justifiably so or not).
Amazon doesn't and regardless nobody feels comfortable using Google, who knows when they'll discontinue a product we would rely on.
So not a lot left to choose from.
> Makes me wonder why enterprises still flock there
Well, when you're already paying Microsoft $/user/month for Intune, Teams&co. you might as well use Azure too.
Only one vendor relationship to manage, and I suspect you probably have to spend far less money than you do with AWS to get some personal attention.
Same reason as it was in 2002. “No one ever got fired for buying Microsoft.”
Lets get our Cloud...from the same guys who have been unable to provide a freeze screen feature in Teams for 10 years..should be a firing offense...
Their sales folks are very good with C level folks, from the meetings I've sat in on. They will give you substantial credits and hands on support to build for you, depending on vertical and predicted future spend, especially if you're already at another cloud provider they're trying to pull you from.
path traversal and IDOR..
likely been active since the inception of these capabilities
wonder if the recommendation to "add randomness to resource names" is because of this (unrelated security by obscurity lol)
God. I would hate to be the engineer forced to have enough Azure experience to be able to find these bugs and understand Azure’s infrastructure on this level.
Should have been addressed in the Geneva conventions.
Reporting cross-Tenant issues as an outsider with a vulnerability chain gets you $$$.
Reporting “theoretical” issues with validation as an Employee gets you a lot of questions as to why you were looking.
Oh well.
> Reporting “theoretical” issues with validation as an Employee
Microsoft still has employees ? ;)
(Sorry. Low bar. But in all honesty I thought they outsourced the majority of ops. I was surprised to hear in recent news that they actually had that many employees left)
[flagged]