Microsoft has revealed that a misconfigured shared access signature (SAS) token exposed company data on GitHub from July 2020 until it was fixed in 2023. The mistake was discovered by Wiz Research and related to a Microsoft GitHub repository used for sharing open source AI code and models for image recognition.
An improperly configured URL granting permissions to the entire storage account exposed 38TB of data, including secrets, private keys, passwords, and over 30,000 Microsoft Teams messages. Microsoft emphasized that no customer data was exposed, as it was a configuration error, not an Azure vulnerability.
Misconfigured SAS Token
Microsoft explained that a researcher at the company inadvertently included the SAS token in a blob store URL while contributing to open-source AI learning models and provided the URL in a public GitHub repository. Microsoft stated that SAS tokens should be created and managed properly, and they are working on ongoing improvements to enhance the SAS token feature’s security.
GitHub Scanning Issue
During its investigation, Microsoft identified a GitHub scanning issue where an overly permissive SAS token in the “robust-models-transfer” repository was incorrectly marked as a false positive. Microsoft has since addressed this issue and continues to evaluate its services to bolster its security posture. The misconfiguration was reported to Microsoft by Wiz Research on July 22, 2023, and the company revoked the token and prevented external access to the storage account on July 23, 2023.
