Microsoft has resolved a security lapse that exposed internal companion files and credentials to the open internet.
Security researchers canful Yoleri, Murat �zfidan and Egemen Ko�hisarl1 with SOCRadar, a cybersecurity companion that helps organizations encounter security weaknesses, discovered an surface and public storage server hosted on Microsofts Azure mottle service that was storing internal info relating to Microsofts Bing lookup engine.
The cerulean storage server housed code, scripts and configuration files containing passwords, keys and credentials used by the Microsoft employees for accessing other internal databases and systems.
But the storehouse server itself was not protected with a password and could live accessed by anyone on the internet.
Yoleri told TechCrunch that the exposed data could potentially assist malicious actors discover or access other places where Microsoft stores its internal files. Identifying those storage locations could result in more significant data leaks and possibly compromise the services in use, Yoleri said.
The researchers notified Microsoft of the security lapse on february 6, and Microsoft secured the spilling files on march 5.
Its not known for how long the defile server was exposed to the internet, or if anyone other than SOCRadar discovered the exposed data inside. When reached by email, a spokesperson for Microsoft did not ply comment by the time of publication. Microsoft did not say if it had reset or changed any of the exposed internal credentials.
