Wiz Research discovers "ExtraReplica"— a cross-account database vulnerability in Azure PostgreSQL

Wiz Research disclosed "ExtraReplica", a chain of critical flaws in Azure Database for PostgreSQL Flexible Server that let an attacker escalate privileges on an attacker-controlled instance and then abuse an overly permissive certificate Common Name validation to impersonate the replication user and replicate/read other tenants' databases; Microsoft was notified, issued fixes, and reported no known exploitation, but publicly accessible Flexible Server instances (non-VNet) were potentially vulnerable.