Azure's Weakest Link - Five Full Cross-Tenant Compromises
Summary
Security researcher reveals severe vulnerabilities in Azure API Connections enabling cross-tenant compromise and full backend access. The post details exploitation techniques such as DynamicInvoke, DynamicList, and RuntimeUrl path traversal, the subsequent fixes, and observed patch timelines. It includes notes on how to mitigate and secure API connections in Azure Logic Apps.