News for hackers. Stuff that matters.

A comment on Microsoft Azure silently install management agents with vulns on your Linux VMs. Parent comment

Re:Microsoft Azure silently install management agents with v... by freenatec on Wednesday September 15, 2021 @02:07PM (#28542348)
One would assume that absence of credentials would necessarily = auth failure.

Like, the basic flow would check the validity and, implicitly, the presence of the auth header. To bypass auth in the case of the absence of the header itself would need to be an explicit conditional. IF no header, then authenticated. Right? That’s crazy.

I suppose I could look at the code.

[ Parent | on HN ]
Re:Microsoft Azure silently install management agents with v... by raxxorrax on Thursday September 16, 2021 @02:43AM (#28548803)
On the other hand MS enforced strict auth policies to access their Office APIs in a ridiculous fashion. When I needed to register my applications at MS, I just dropped integration into their services and I never looked back.
[ Parent | on HN ]
Re:Microsoft Azure silently install management agents with v... by ReactiveJelly on Wednesday September 15, 2021 @07:28PM (#28545816)
That's the kind of thing where a unit test would be useful and easy..

I'd probably forget to write it... but it would be useful and easy.

[ Parent | on HN ]