Skip to main content

Month Archives: December 2021

Azure App Service Linux source repository exposure

Wednesday, December 22, 2021

MSRC was informed by, a cloud security vendor, under Coordinated Vulnerability Disclosure (CVD) of an issue where customers can unintentionally configure the .git folder to be created in the content root, which would put them at risk for information disclosure. This, when combined with an application configured to serve static content, makes it possible for others to download files not intended to be public.

Researcher Spotlight: Dr. Nestori Syynimaa’s Constant Mission Protecting Identities

Tuesday, December 14, 2021

“When you find the things I find, they really matter. They affect everybody’s security.” Currently streaming : The Expanse and Lost in Space on Netflix Currently listening to : Amorphis, Architects, and Killswitch Engage Currently running : 130 kilometers (or ~80 miles) a month Currently playing : Floorball (a type of floor hockey with five players and a goalkeeper)

Microsoft’s Response to CVE-2021-44228 Apache Log4j 2

Sunday, December 12, 2021

Published on: 2021 Dec 11, updated 2022 Apr 6. SUMMARY Microsoft continues our analysis of the remote code execution vulnerabilities related to Apache Log4j (a logging tool used in many Java-based applications) disclosed on 9 Dec 2021. Currently, Microsoft is not aware of any impact, outside of the initial disclosure involving Minecraft: Java Edition, to the security of our enterprise services and has not experienced any degradation in availability of those services as a result of this vulnerability.