Five cross-tenant Azure bugs, one shared API Management instance, $200,000 in bounties (binarysecurity.no)
A Binary Security researcher found that Azure API Connections swap a user's token for the backend's through one shared API Management instance, so security rests on input validation. Path traversal in DynamicInvoke read a secret from another tenant's Key Vault; later bypasses reopened the hole after each fix.
Sign in to save