16-year-old researcher found a Microsoft bug, got admin access to databases with 17.3 trillion rows
A 16-year-old researcher bypassed unsigned JWT checks on Microsoft Titan and gained admin SQL access to analytics databases estimated at 17.3 trillion rows.
Faav, a 16-year-old researcher, found that Microsoft’s internal Titan analytics service accepted JSON Web Tokens without verifying their signatures. Changing an unsigned token’s user principal name to admin resolved to local user ID 1 and allowed SQL queries as an administrator. He reported access to platform metadata, including roughly 17,990 employee email records, and estimated about 17.3 trillion rows across 17 connected analytics databases. Microsoft stopped further testing, locked down the API, and awarded a $5,000 bounty on September 17.
- Unsigned JWTs were accepted and the UPN admin mapped to local admin user ID 1.
- Metadata exposed roughly 17,990 employee emails, 355 database configs, and thousands of dashboards.
- Thirty active routes resolved to 17 analytics databases and about 17.3 trillion stored rows.
- Microsoft halted testing, locked the API, and paid Faav a $5,000 bug bounty.
- He used a homemade AI bot named Antares and later cut details at Microsoft’s request.
- Vendors
- Microsoft
- Products
- TitanAzure Cloud Services
- Victims
- Microsoft
- Organizations
- Microsoft
From the original article
3 min read at theregister.comA 16-year-old security researcher named Faav found an authentication flaw in Microsoft’s Titan analytics service that allowed him to gain administrator access, submit unauthorized SQL queries with no valid credentials, and potentially reach analytics databases containing an estimated 17. 3 trillion stored rows.
By Jessica Lyons · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.