2 ms·
Is it me or was there a similar vulnerability reported a few years ago? Something about the attacker getting access to all platform's users' databases, though n
by sakisv 2mo ago
Is it me or was there a similar vulnerability reported a few years ago? Something about the attacker getting access to all platform's users' databases, though not sure if it was cosmos or something similar.
- ultra2d 2mo agoThis one from a year ago? https://dirkjanm.io/obtaining-global-admin-in-every-entra-id-tenant-with-actor-tokens/ https://dirkjanm.io/obtaining-global-admin-in-every-entra-id... "This vulnerability could have allowed me to compromise every Entra ID tenant in the world (except probably those in national cloud deployments)."
- sakisv 2mo agooh ffs, I forgot about this. I was thinking of the other one though from 2021 mentioned in a sibling comment, and it was indeed, again, with cosmos
- chatmasta 2mo agoThere have been a lot. I remember one that was essentially “send the request without an Authorization header.”
- FromOmelas 2mo agoYes. you're thinking of https://www.wiz.io/blog/chaosdb-explained-azures-cosmos-db-vulnerability-walkthrough https://www.wiz.io/blog/chaosdb-explained-azures-cosmos-db-v...