conv.

← The whole story
Security
Researcher discloses five cross-tenant Azure API vulnerabilities worth $200K

Researcher publishes five cross-tenant compromise vulnerabilities in Azure API Connections

1 Oct 30 · 12d ago · 1 article · 2 posts · 3 sources · development 1 of 2

Security researcher detailed a series of vulnerabilities in Azure Logic Apps' API Connections architecture that enable attackers to compromise any connection worldwide and access victim backends including Key Vaults, SQL databases, Jira, and Salesforce. The research builds on two previous posts in the series and earned the researcher $200,000 in bug bounties.

“API Connections allow anyone to fully compromise any other connection worldwide, giving full access to the connected backend.”

Binary Security researcher

Binary Security researcher Security researcher, bug bounty recipientMicrosoft Azure service provider

The whole story articlesposts the bright band is this development · numbered dots are the others · click one to jump

Peak 5 pieces in 3h at Oct 30, 7 AM; 19 pieces over 14 days (2 articles · 4 posts · 13 comments) Oct 29, 10 AM — 1 piece · 1 post — Lobsters 1Oct 29, 1 PM — quietOct 29, 4 PM — quietOct 29, 7 PM — quietOct 29, 10 PM — quietOct 30, 1 AM — quietOct 30, 4 AM — 3 pieces · 2 articles · 1 post — Newswires 2, Hacker News 1Oct 30, 7 AM — 5 pieces · 1 post · 4 comments — Hacker News 4, Mastodon 1Oct 30, 10 AM — 5 pieces · 5 comments — Hacker News 5Oct 30, 1 PM — 1 piece · 1 post — Mastodon 1Oct 30, 4 PM — 3 pieces · 3 comments — Hacker News 3Oct 30, 7 PM — quietOct 30, 10 PM — quietOct 31, 1 AM — quietOct 31, 4 AM — quietOct 31, 7 AM — 1 piece · 1 comment — Hacker News 1Oct 31, 10 AM — quietOct 31, 1 PM — quietOct 31, 4 PM — quietOct 31, 7 PM — quietOct 31, 10 PM — quietNov 1, 1 AM — quietNov 1, 3 AM — quietNov 1, 6 AM — quietNov 1, 9 AM — quietNov 1, 12 PM — quietNov 1, 3 PM — quietNov 1, 6 PM — quietNov 1, 9 PM — quietNov 2, 12 AM — quietNov 2, 3 AM — quietNov 2, 6 AM — quietNov 2, 9 AM — quietNov 2, 12 PM — quietNov 2, 3 PM — quietNov 2, 6 PM — quietNov 2, 9 PM — quietNov 3, 12 AM — quietNov 3, 3 AM — quietNov 3, 6 AM — quietNov 3, 9 AM — quietNov 3, 12 PM — quietNov 3, 3 PM — quietNov 3, 6 PM — quietNov 3, 9 PM — quietNov 4, 12 AM — quietNov 4, 3 AM — quietNov 4, 6 AM — quietNov 4, 9 AM — quietNov 4, 12 PM — quietNov 4, 3 PM — quietNov 4, 6 PM — quietNov 4, 9 PM — quietNov 5, 12 AM — quietNov 5, 3 AM — quietNov 5, 6 AM — quietNov 5, 9 AM — quietNov 5, 12 PM — quietNov 5, 3 PM — quietNov 5, 6 PM — quietNov 5, 9 PM — quietNov 6, 12 AM — quietNov 6, 3 AM — quietNov 6, 6 AM — quietNov 6, 9 AM — quietNov 6, 12 PM — quietNov 6, 3 PM — quietNov 6, 6 PM — quietNov 6, 9 PM — quietNov 7, 12 AM — quietNov 7, 3 AM — quietNov 7, 6 AM — quietNov 7, 9 AM — quietNov 7, 12 PM — quietNov 7, 3 PM — quietNov 7, 6 PM — quietNov 7, 9 PM — quietNov 8, 12 AM — quietNov 8, 3 AM — quietNov 8, 6 AM — quietNov 8, 9 AM — quietNov 8, 12 PM — quietNov 8, 3 PM — quietNov 8, 6 PM — quietNov 8, 9 PM — quietNov 9, 12 AM — quietNov 9, 3 AM — quietNov 9, 6 AM — quietNov 9, 9 AM — quietNov 9, 12 PM — quietNov 9, 3 PM — quietNov 9, 6 PM — quietNov 9, 9 PM — quietYesterday, 12 AM — quietYesterday, 3 AM — quietYesterday, 6 AM — quietYesterday, 9 AM — quietYesterday, 12 PM — quietYesterday, 3 PM — quietYesterday, 6 PM — quietYesterday, 9 PM — quietToday, 12 AM — quietToday, 3 AM — quietToday, 6 AM — quietToday, 9 AM — quietToday, 12 PM — quietToday, 3 PM — quietToday, 6 PM — quiet 1–2
1–2Researcher publishes five cross-tenant…
Oct 30Oct 31Nov 1Nov 2Nov 3Nov 4Nov 5Nov 6Nov 7Nov 8Nov 9yesterdaynow · 9:48 PM ET

What was reported 1 claim about this development

  1. 2 outlets Azure's Weakest Link – Five Full Cross-Tenant Compromises

    first by HN Best, 12d ago · also HN Frontpage

All 2 developments of Researcher discloses five cross-tenant Azure API… →

LobstersHacker NewsNewswiresMastodon