16-year-old researcher found a Microsoft bug, got admin access to databases with 17.3 trillion rows
ID: dff90f08-2371-5903-a181-6f7ffee91918
STIX ID: report--dff90f08-2371-5903-a181-6f7ffee91918
Feed Name: The Register (Security)
Threat Score
A 16-year-old researcher discovered a JWT signature verification flaw in Microsoft’s internal Titan analytics platform that allowed unsigned tokens to be treated as an admin identity, enabling execution of SQL queries and access to metadata and backend analytics databases estimated at ~17.3 trillion rows; Microsoft investigated, locked down the API, and issued a $5,000 bug bounty after coordinated disclosure.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.