Microsoft rejects critical Azure vulnerability report, no CVE issued(bleepingcomputer.com)

Microsoft rejects critical Azure vulnerability report, no CVE issued

https://www.bleepingcomputer.com/news/security/microsoft-rejects-critical-azure-vulnerability-report-no-cve-issued/

3 comments

I'm the researcher. You've nailed it — Backup Contributor automatically granted cluster-admin via Trusted Access, no K8s permissions required. Microsoft called it "expected behavior," then silently patched it.

Full writeup with CERT/CC timeline and evidence: https://olearysec.com/research/azure-backup-aks-silent-patch...

bell-cot2 ay önce

Not that I'm an Azure expert, or trust Microsoft to tell the truth...but any privilege with "backup" in its name strikes me as security-critical.

Any experts care to comment?

winstonwinston2 ay önce

I think it’s problematic that one permission was automatically adding another high trust permission, that they argued as expected behavior and then they silently changed this behavior, fixing the reported security issue.