Microsoft AI researchers exposed 38TB via an over-permissive Azure SAS link

Microsoft Azure Storage (SAS token in a GitHub repo)

Follow this incident

RSS
JSON
llms.txt

Updated Sep 18, 2023

Updates on Sep 18, 2023

Sep 18, 2023
Public disclosure by Wiz and Microsoft
Source

Summary

A public GitHub repo of Microsoft AI training models shared an Azure Storage SAS token with full-control permissions on a whole storage account. It exposed 38TB of internal data, including workstation backups, secrets and Teams messages. Wiz found and reported it.

Read the full incident →

Advisories1

Microsoft mitigated exposure of internal information in a storage account due to overly-permissive SAS tokenMicrosoft · Sep 18, 2023

Get notified