![Cross Tenant Vulnerabilities Could Soon Spell a Curse on Microsoft Azure](http://media.assettype.com/analyticsinsight%2Fimport%2Fwp-content%2Fuploads%2F2022%2F06%2FCross-Tenanct-Vulnerabilities-Could-soon-Spell-a-Curse-on-Microsoft-Azure.jpg?w=480&auto=format%2Ccompress&fit=max)
Microsoft is reporting that a vulnerability in its Azure Automation service was mitigated in December, following its discovery by a researcher at Orca Security, and that there's no evidence the vulnerability was exploited by hackers. Had it not been caught and fixed, the critical vulnerability could have allowed someone to cross from one tenant within Azure to another tenant — potentially allowing them to access data and resources from numerous other customers, according to Orca Security.
AutoWarp potentially would have allowed unauthorized users to access other Azure customer accounts using the Azure Automation service — potentially enabling full control over the data and resources in targeted accounts, based on how permissions were configured, according to Orca.
The company said in a blog that its research showed that "multiple large companies were using the service and could have been accessed, putting billions of dollars at risk." This included two car makers, a major telecommunications company, a banking conglomerate, and one of the "big four" accounting firms, Orca said.
Reuters first reported on the vulnerability, which was discovered by Wiz research team.
Microsoft fixed the vulnerability within 48 hours of its disclosure on August 12, but that the vulnerability had been exploitable since mid-2019, according to Wiz researchers. Microsoft notified roughly over 30% of its clients about the data exposure, but researchers warn that the effects were likely more widespread.
"Every Cosmos DB customer should assume they've been exposed," Wiz researchers wrote.
Microsoft has asked customers to reset keys to their accounts as a precautionary measure, according to an email sent from the company to customers shared by a Wiz researcher.
Microsoft declined to share how many companies it notified about the potential breach.
Microsoft customers have endured a series of high-stakes vulnerabilities in the past year, at least two of which had to do with its email client Exchange.
According to protocol, last month, Microsoft also resolved a pair of issues — dubbed "ExtraReplica" — with the Azure Database for PostgreSQL Flexible Server that could result in unapproved cross-account database access in a region.
Limitations with Microsoft Azure's Cross Tenant
Join our WhatsApp Channel to get the latest news, exclusives and videos on WhatsApp
_____________
Disclaimer: Analytics Insight does not provide financial advice or guidance. Also note that the cryptocurrencies mentioned/listed on the website could potentially be scams, i.e. designed to induce you to invest financial resources that may be lost forever and not be recoverable once investments are made. You are responsible for conducting your own research (DYOR) before making any investments. Read more here.