This means that if an attacker could execute code on the integration runtime, it is never shared between two different tenants, so no sensitive data is in danger. A sandbox – Move the shared integration runtime to a sandboxed ephemeral VM.
When reporting the issue Orca suggested to Microsoft to implement a number of mitigations, mainly: The report included Orca’s concerns about the weak implementation of tenant separation in this service, as well as the fact that it was possible to download highly privileged internal Microsoft keys. The Orca research team reported SynLapse to Microsoft Security Response Center (MSRC) in early January 2022, in accordance with the industry-standard 90-day coordinated vulnerability disclosure process.
0 kommentar(er)
