I hacked into a Bing CMS

  • Even with all these crazy CVEs / new attack techniques, basic misconfigurations are still the cause of most cloud breaches!

    I wonder why Bing's cloud configuration checker didn't catch this multi-tenancy misconfig. Or if they did, where did it get lost in the alert triaging?

  • This could have had massive consequences in the wrong hands.