Cloud Security Office Hours Banner

Microsoft SAS Leak 2023 — 2023

Step-by-step kill chain mapped to MITRE ATT&CK Cloud, sourced from official post-mortems and primary technical analyses.

July 2020 – June 2023 (3-year exposure) Critical Azure Blob Storage

Microsoft AI Research SAS Token — Over-Permissioned Token → Public GitHub → 38TB Internal Data Exposed for 3 Years

A Microsoft AI researcher shared a URL to open-source training data on a public GitHub repository. The URL contained an Azure Shared Access Signature token — but instead of being scoped to a specific file or container, it was an Account SAS with full-control permissions to the entire storage account, set to expire in 2051. Anyone who found the URL could read, modify, or delete 38TB of internal Microsoft data including employee workstation backups, private keys, saved passwords, and 30,000+ internal Teams messages. Discovered and responsibly disclosed by Wiz Research in June 2023 after ~3 years of exposure.

38 TB exposed
3 years exposure window
Full control permissions (read + write + delete)
Discovered by: Wiz Research (responsible disclosure)
📄 Wiz Research disclosure ↗ 📄 BleepingComputer ↗
🔧 Root Cause — Misconfigured SAS Token
01
Researcher creates Account SAS with full-control permissions, 30-year expiry
T1098.004 – SSH Authorized Keys (analogous: overpermissioned access token)

When sharing open-source AI training data publicly, the researcher used Azure's SAS token feature but chose the broadest option — an Account SAS — rather than a narrowly-scoped Service SAS. They set permissions to "full control" (read, write, delete) and the expiry to October 2051. Azure does not audit SAS token generation, making this invisible to administrators.

SAS type: Account SAS (entire storage account) — should have been Service SAS (single container)
Permissions set: Full control — read, write, delete, list everything
Expiry set: October 6, 2051 (30+ years)
Azure's own warning: "Not possible to audit generation of SAS tokens" — no admin visibility
Account SASFull Control30-Year ExpiryMisconfiguration
📢 Exposure — Committed to Public GitHub
02
Full SAS token URL committed to public GitHub repository README (July 20, 2020)
T1552.004 – Private Keys

The researcher committed the complete SAS token URL to the public GitHub repository "robust-models-transfer" as download instructions. GitHub's secret scanning did not cover Account SAS token patterns at the time. The URL was publicly visible for nearly 3 years. In October 2021, the token was renewed — with the expiry extended to October 2051.

Repository: github.com/microsoft/robust-models-transfer (public)
Exposed from: July 20, 2020 to June 24, 2023 (2 years 11 months)
Token renewed: October 2021 — expiry extended to 2051 (30 more years)
Scanning gap: GitHub secret scanning did not cover Account SAS tokens until after this disclosure
GitHubPublic RepositorySecret in READMET1552.004
📂 Data Accessible — 38TB Including Credentials
03
Full storage account accessible — 38TB including employee backups, keys, Teams messages
T1530 – Data from Cloud Storage

Anyone with the URL had full access to an internal Azure Blob storage account — not just the intended training data folder. The account contained disk backups of two Microsoft employees' workstations with saved passwords, private keys, and an archive of 30,000+ internal Microsoft Teams messages. Full-control permissions also meant a malicious actor could have injected code into AI model files, creating a supply chain attack vector.

Exposed data:
→ Disk backups of 2 employee workstations (passwords, private keys, personal data)
→ 30,000+ Microsoft Teams messages from 359 employees
→ Internal credentials and secret keys
→ Intended open-source AI training data
Supply chain risk: Write access meant an attacker could have injected malicious code into AI model files
38TBEmployee CredsTeams MessagesAI Supply Chain RiskT1530
🔬 Discovery — Wiz Research Internet Scan
04
Wiz Research discovers token while scanning GitHub for misconfigured cloud storage — June 22, 2023

Wiz Research runs an ongoing project scanning the internet and public repositories for misconfigured cloud storage. While reviewing Microsoft's public AI GitHub repositories, they found the SAS token URL, followed it, and discovered the full scope of exposure. They reported to Microsoft MSRC on June 22; the token was revoked on June 24, 2023 — 2 days later. Coordinated public disclosure followed on September 18, 2023.

Discovered by: Wiz Research (scanning public GitHub repos for cloud misconfigurations)
Reported: June 22, 2023 | Token revoked: June 24, 2023 (48 hours)
GitHub URL updated: July 7, 2023 | Public disclosure: September 18, 2023
No evidence: Microsoft found no evidence of malicious exfiltration beyond Wiz's research
Responsible DisclosureWiz Research3 Year ExposureNo Malicious Exfil Confirmed

🛡 How to Defend Against This Chain

Never use Account SAS for external sharing — always use Service SAS with a Stored Access Policy. Service SAS scopes access to a single container. A Stored Access Policy allows central management and instant revocation without rotating the account key.
Configure and enforce SAS expiration policies at the Azure storage account level. Azure allows you to set a maximum SAS token lifetime. A 30-year token should never be possible. Set limits (e.g., 24 hours for external sharing) and alert on violations.
Run secret scanning across all repositories including SAS token patterns. Trufflehog, GitLeaks, and GitHub Advanced Security can detect SAS tokens in code. Microsoft added Account SAS token patterns to GitHub's secret scanning service following this disclosure.
Separate internal data from public data at the storage account boundary. Open-source training data should live in a dedicated storage account with no internal data co-located. Misconfiguration then limits the blast radius to the public data account only.
Monitor SAS-authenticated access via Azure Monitor and Storage Analytics logs. Alert on access from unexpected IPs or at unusual times for storage accounts holding sensitive data. Enable SAS token expiration policies to catch long-lived tokens automatically.