[carlospolop]

Blog URL

https://research.eye.security/ghosts-in-the-cloud-hijacking-orphaned-azure-blob-storage

Blog Title

Ghosts in the Cloud: Hijacking Orphaned Azure Blob Storage

Blog high summary

Researchers enumerated >15,000 Azure Blob names, registered 621 abandoned accounts, and used Azure Log Analytics to observe active requests. Any live https://{name}.blob.core.windows.net reference became attacker-controlled content after the name was claimed; the prerequisite was an unregistered name plus an active consumer.

Impact included PowerShell execution opportunities, browser-context JavaScript/stored XSS, DOM and token exposure, defacement, malware/package delivery, and Referer-secret leakage. The post includes a benign IP-allowlisted console-logging PoC for disclosure; it names no CVE.

PR changes

• src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-storage-unauth.md: Added direct Blob URL takeover prerequisites, validation and consumer-discovery guidance, with a cross-link distinguishing dangling-CNAME takeover.

Errors

mdbook build unavailable

[carlospolop]

Decision: keep

The base book covers dangling-CNAME takeover, but not replacement content served through a direct Azure-managed Blob URL. The original research and Microsoft documentation support the mechanism, anonymous-access prerequisites, consumer-dependent impact, and log-based discovery. All 15 AWS pages exist and were absent from the base SUMMARY. Their 30 newly exposed broken links now resolve to…

Head: 2450069e60d0380708025e78c50e1eac455aef0a

[carlospolop]

merge