# 38TB of data accidentally exposed by Microsoft AI researchers

Microsoft AI researchers committed an over-privileged, non-expiring Azure Account SAS token to GitHub, exposing 38TB of private data including workstation backups and Teams messages.

- Payout: Research
- Severity: high
- Program: Microsoft
- Write-up by: Wiz Research
- Disclosed: 2023-09-18
- Write-up quality: 7/10
- Original: https://www.wiz.io/blog/38-terabytes-of-private-data-accidentally-exposed-by-microsoft-ai-researchers
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-38-terabytes-of-private-data-accidentally-exposed-by-microsoft-ai-researchers
- Tags: area:cloud domain:cloud impact:data-leak impact:pii-leak kind:research platform:threat-intel sev:high tech:azure tech:github-actions technique:recon technique:source-review vuln:misconfiguration vuln:secrets-leak

**Target:** Azure Storage account SAS token in a public GitHub repo
**Root cause:** An Account SAS token scoped to the entire storage account with full-control permissions and an expiry set to Oct 6, 2051 was committed to a public GitHub repository, so anyone with the link could read/write/delete all containers.
**Steps:**
1. Scan the internet for misconfigured cloud storage containers.
2. Find GitHub repo `robust-models-transfer` under the Microsoft org instructing users to download models from an Azure Storage URL.
3. Inspect the URL: it is an Account SAS token granting full control on the entire storage account, not just the model file.
4. Use the token to list and download other containers, revealing 38TB of additional data including workstation backups.
5. Note the token expiry was set to Oct 6, 2051.
**How found:** Wiz's ongoing internet-wide scan for misconfigured storage containers surfaced a Microsoft GitHub repo whose download URL was an Account SAS token; inspecting the token's scope and permissions revealed it covered the whole account with full control.
**Exploitation:** Anyone reading the public repo could use the SAS link to list and download all containers in the storage account (38TB, including secrets, private keys, passwords, 30k Teams messages). Full-control permission also allowed deleting/overwriting files; since the repo told users to feed the ckpt (pickle) model files into a script, an attacker could have injected code into the models for a supply-chain RCE against downstream users.
**Escalation:** Write access to the model files plus pickle deserialization in the documented workflow could turn data exposure into a supply-chain code-execution attack on researchers using the repo.
**Insight:** SAS tokens are signed client-side and are not Azure objects, so a storage account can look private while a leaked URL grants full account access; when you find a cloud storage link in a public repo, decode the SAS parameters (sp, sr, se) to check scope, permissions and expiry rather than assuming it's a single-file read link.