A flaw in Titan, an internal Microsoft analytics service, could have let an attacker read employee records and Bing search analytics, a 16-year-old security researcher has disclosed.
The researcher, who goes by Faav, found that Titan did not verify the signature on login tokens. That let him pose as the service’s administrator and run SQL queries against 17 connected databases holding an estimated 17.3 trillion rows.
He did this with the help of Antares, an automated bug-hunting tool he built himself. His write-up says Antares flagged Titan and spent ten days working through its login checks before he took the final step himself.
“Antares wouldn’t have gotten here alone, and neither would I. Its persistence, plus one human hunch, is what made this find possible.”
Getting past the token checks
Titan’s web interface was only reachable over a Microsoft VPN, but Antares found a separate API endpoint with public documentation. One of its routes, /v2/Query, accepted raw SQL.
Requests without an authorization header were refused. While Faav worked through hundreds of other leads, Antares kept returning to Titan.
“It started with a token from my external Entra test tenant, created months earlier and used regularly for testing. Titan threw back a tenant error. Changing the tenant to Microsoft’s reached an audience error. Changing the audience hit an application allowlist error. Changing the application ID finally reached a user lookup,” the young researcher explained.
“The payload kept changing while the signature stayed exactly the same, and Titan kept accepting the new claims, like a bouncer checking the name on every ID but never looking at the photo. That was the first big clue it wasn’t verifying signatures,” he added.
Faav then sent a token with the algorithm set to “none” and an empty signature section. It passed every check and got as far as the user lookup, which returned a “user not found” error.
For days, Antares tried email-style addresses in the token’s upn field. On September 5, Faav changed the value to “admin”. Titan treated the field as a local username and matched it to user ID 1, which held the Admin role. That gave Faav administrator access and let him run SQL queries on the service.
Employee records and Bing search data
Titan’s platform metadata database held approximately 25,000 account and email entries, 17,990 employee email records and 15,001 employee organization records, Faav wrote. The employee information included job titles, departments and management hierarchy for staff associated with Titan.
An application user record with identifying information and login activity (Source: Blog post)
He noted that this covered a subset of Microsoft’s workforce and that it could have helped an attacker craft targeted social engineering attempts, something he did not test.
The teenager also reached a Bing analytics source and pulled two one-row samples from its latest partition. These contained search, identifier and location fields. The location values showed country or state-level information derived from reverse IP lookups, he explained.
Because MUIDs, identifiers that Microsoft stores in users’ browsers, appeared in more than one dataset, it is plausible that user activity could have been correlated between services, according to Faav.
Faav called the 17.3 trillion figure a storage estimate from database metadata that likely includes historical, duplicated and derived data.
Disclosure and Microsoft’s response
Faav reported the vulnerability to the Microsoft Security Response Center (MSRC) on September 5. MSRC asked him to stop testing and requested his IP address to confirm there was no activity beyond his research. The endpoint was locked down on September 9, and he received a $5,000 bounty on September 17.
He stressed that he never touched customer data or PII, and did not use the two Bing samples to identify anyone, link records between datasets or build profiles.
“We appreciate the opportunity to investigate the findings reported by Faav. Their submission and coordinated vulnerability disclosure helped us to better protect our customers by hardening our services. We value and appreciate safe security research under the terms of the Microsoft Bug Bounty Program and look forward to continuing to work with Faav in the future,” reads a Microsoft statement included in his post.
Faav revealed that Microsoft had editorial control over the post, and that the company cut sections and figures and reworded how the impact was described before publication.
