Microsoft AI researchers exposed 38TB via an over-permissive Azure SAS link

Microsoft Azure Storage (SAS token in a GitHub repo)

Follow this incident

RSS
JSON
llms.txt

Updated Sep 18, 2023

Updates on Jun 22, 2023

Jun 22, 2023
Wiz reports the exposure to Microsoft
Source

Summary

A public GitHub repo of Microsoft AI training models shared an Azure Storage SAS token with full-control permissions on a whole storage account. It exposed 38TB of internal data, including workstation backups, secrets and Teams messages. Wiz found and reported it.

Read the full incident →

Advisories1

Microsoft mitigated exposure of internal information in a storage account due to overly-permissive SAS tokenMicrosoft · Sep 18, 2023

Get notified