I could've accessed 17T Microsoft records
A 16-year-old security researcher found an unsigned JWT vulnerability in Microsoft's Titan analytics service, exposing access to an estimated 17 trillion database records.
read it The post details a real-world bug hunting workflow combining custom AI tooling with a classic signature-bypass vulnerability to expose multi-terabyte internal cloud databases.
summary
A 16-year-old researcher, aided by a custom AI tool named Antares, discovered that Microsoft's internal Titan analytics API failed to validate JWT signatures. By substituting an unsigned token with an admin username claim, the researcher bypassed authentication checks to execute arbitrary SQL queries. This flaw exposed platform metadata, employee records, and bounded samples of Bing analytics across 17 connected databases. Microsoft patched the endpoint after disclosure and awarded a $5,000 bounty, though the incident underscores ongoing challenges with internal cloud service security and authentication specs.
key points
- The Titan API accepted JWTs using the insecure alg:none header because backend handlers verified claim fields like tenant and audience but omitted signature verification entirely.
- Changing the token's upn claim to the literal string admin mapped to local user ID 1, granting administrative query execution privileges without credentials.
- The vulnerability exposed 30 active routing targets across 17 connected ClickHouse analytics databases containing an estimated 17.3 trillion rows of data.
who should read it
Security engineers, bug bounty hunters, and developers interested in authentication failure modes and AI-assisted vulnerability discovery.
discussion positive
consensus
Commenters widely praise the young researcher's talent while expressing disbelief that Microsoft paid a modest $5,000 bounty for such a critical bug and forced editorial changes on the write-up.
pushback
A few commenters debate whether the none algorithm in the JWT specification or developer implementation failure is more to blame for recurring token security issues.
There is an internal library at Microsoft that reliably avoids all these JWT problems - Microsoft Identity Service Essentials (MISE). Adopting MISE and upgrading to the latest versions of it have been part of the Secure Future Initiative (SFI) that can be read about in the news of previous years. Unfortunately it sounds like the service team intentionally deferred the compliance alerts they will have received.
It points out that Microsoft has an internal library called MISE designed to prevent these exact JWT errors, suggesting the bug stemmed from skipped compliance or delayed updates.
Generated by an LLM from the article and thread. Check the sources before relying on it.