A 16-year-old security researcher, known as Faav, discovered an authentication flaw in Microsoft's internal analytics service, Titan, which granted him administrator access and the ability to execute unauthorized SQL queries. This vulnerability potentially exposed analytics databases containing an estimated 17.3 trillion rows of data. Microsoft has since addressed the issue and awarded Faav a $5,000 bug bounty.
Titan is an internal analytics platform whose web interface is restricted to Microsoft employees. Faav, with assistance from an AI tool he developed named Antares, found that Titan's API, hosted on an Azure Cloud Services host, failed to validate the signature on login tokens. This oversight allowed him to bypass authentication checks.
The research began on August 25, when Antares identified Titan's public API. Over the next ten days, Faav and his bot investigated the service's JSON Web Token (JWT) authentication and user principal names (UPNs). They eventually discovered that an unsigned token could access Titan's local user lookup, but initially, no recognized UPN was found.
In the early hours of September 5, Faav modified the UPN within an unsigned token from an email-formatted identity to "admin." Titan then recognized this as a local username, resolved it to local user ID 1, which held an administrator role, and permitted him to execute SQL commands. Faav noted that while Titan validated other JWT contents like tenant, audience, app ID, and user, it critically failed to verify the signature.
This access enabled Faav to query Titan's platform metadata database directly. The metadata included approximately 25,000 account and email records, 17,990 employee email records, 15,001 employee organization records, 355 database configurations, 20,979 virtual-dataset SQL definitions, 24,569 dashboards, 425,891 charts, and 27,347 dataset definitions. The user and usage directory also exposed employee job titles, departments, and management hierarchies, which Faav noted could be useful for social engineering, though he did not test this. He also found a Bing analytics sample containing search information, identifiers, and high-level location data, such as country or state, but no precise user locations.
Further investigation revealed 30 active routing values out of 56 tested from an archived configuration. These values resolved through 24 configurations to 17 connected analytics databases, encompassing 9,863 unique table names. The estimated 17.3 trillion rows represent a storage estimate derived from metadata, likely including historical, duplicated, and derived data.
Between September 6 and September 8, Microsoft requested Faav to cease testing and provided his IP address to confirm that no malicious activity beyond the bug bounty research had occurred. By September 9, Microsoft had secured the endpoint and informed Faav that his report prompted immediate investigation and remediation. The bug bounty was officially awarded on September 17.
Microsoft confirmed that Faav's submission and coordinated vulnerability disclosure helped them enhance the security of their services. They expressed appreciation for safe security research conducted under the terms of their Bug Bounty Program. Faav also stated that he revised his blog post about the findings at Microsoft's request, removing certain sections and numbers, and rephrasing the impact prior to publication.
