Azure SDK for Java

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical - deserialization of untrusted data or code injection, high-quality report │ $15,000 │ $16,000 Critical - authentication issues, improper access control, SSRF, or SQL and command injection │ $12,000 │ $13,000 Important - deserialization of untrusted data or code injection │ $10,000 │ $11,000 Critical - XSS, CSRF, cross-origin access, improper input validation, web misconfiguration │ $8,000 │ $9,000 Important - authentication issues, improper access control, SSRF, or SQL and command injection │ $6,000 │ $7,000 Critical - GitHub Actions in the repository │ $5,000 │ $6,000 Important - XSS, CSRF, cross-origin access, improper input validation, web misconfiguration │ $4,000 │ $5,000 Important - GitHub Actions in the repository │ $3,000 │ $3,750 Moderate and Low, every vulnerability type │ $0 │ $0 Submit a vulnerability CVE history 1 Last 12 months 2 Lifetime Auth bypass 30 % Info disclosure 25 % Code execution 25 % Access control 15 % Latest advisories Loading the feed Overview Azure SDK for Java is the client path JVM applications take to reach Azure: azure-identity for credentials, azure-core for the HTTP pipeline every generated client sits on, the azure-storage-* clients, and the Spring Cloud Azure modules that wire all of it into Spring Boot. The population it reaches is smaller than the JavaScript or Python SDKs but materially more sensitive, because Java deployments skew towards long-lived backend estates in finance, healthcare and government: Spring Boot services on App Service and AKS, Kafka and Event Hubs consumers, and Databricks and Synapse jobs. It also carries a risk class the other language SDKs do not carry to the same degree: the generated service clients deserialize XML and JSON, which on the JVM is the classic gadget-chain surface, and that is precisely the row Microsoft prices at the top of its grid. Microsoft pays through the MSRC Researcher Portal on the Open Source Bounty Program, where a high-quality Critical deserialization or code-injection report reaches $15,000, authentication and access-control issues reach $12,000, and Moderate and Low findings pay nothing at all. sorona.xyz adds 1.25× on top of whatever Microsoft awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope The whole of azure/azure-sdk-for-java , which the program names on its SCOPE list under "Azure SDKs, limited to the following", at Critical or Important severity on the most recent actively maintained branch azure-core and the modules beneath it: the HTTP pipeline and every policy on it, the Netty and OkHttp transports, the JSON and XML serialization adapters, and the tracing hooks each generated client inherits azure-identity : every credential type the library ships, the chained credentials, token acquisition and the token cache The generated service clients across the whole catalogue, azure-storage-* , Key Vault, Cosmos, Service Bus, Event Hubs, App Configuration and the rest: request construction, URL and SAS handling, and response deserialization The Spring Cloud Azure integration modules, which are Microsoft-owned code inside this repository and covered on that basis The azure-resourcemanager-* control-plane clients and the shared AMQP and Netty modules the data-plane clients build on The repository's own build, release and publish GitHub Actions workflows, which the program prices in a band of their own Out of scope Microsoft and Azure repositories outside the program's fifteen-entry SCOPE list: the standard SECURITY.md pointing at MSRC is a reporting path and funds nothing Azure service-side defects, which belong to Microsoft's separate Azure bounty program: the bug has to live in the client library Spring Framework, Jackson, Netty and other upstream third-party library defects, even when this SDK reaches them, because only Microsoft-owned code in the repository counts Findings whose impact stays on the local machine, since this repository sits outside the carve-out Microsoft grants to VS Code, Agent Framework, TypeScript, Monaco Editor and PowerShell Moderate and Low severity, which pay $0 at every report quality Samples, tutorials, quickstart code and anything under samples/ Hackathon repositories and dependency-confusion reports Issues that have already been publicly disclosed Reports Microsoft cannot pay out on: residency in a sanctioned country, or no IRS tax form returned within 30 days of validation, voids the award Most-valued findings Deserialization of untrusted data in the generated service clients, where a hostile or compromised service response drives a gadget chain into code execution inside a JVM process. This is the class carrying the $15,000 top band and the surface that makes this SDK distinct from its siblings A credential-chain flaw in azure-identity that yields a token for an identity or scope the caller was never entitled to, which is the $12,000 authentication band and matches the 30% auth-bypass share of this repository's history Bearer-token challenge or redirect handling in the azure-core pipeline that sends an Azure access token to a host outside the intended endpoint, since every generated client inherits that policy at once SAS token construction or URL parsing in the storage clients that produces a credential granting broader access, or a different resource, than was requested Injection or improper access control in the Spring Cloud Azure modules, which sit at the boundary between application-supplied configuration and Azure resource access in exactly the enterprise estates this SDK is deployed in Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Only the repositories listed under "Azure SDKs, limited to the following" qualify, and azure/azure-sdk-for-java is on that list by name Only Microsoft-owned code in the repository counts: Spring Framework, Jackson and other upstream third-party defects belong with those projects and pay nothing here Only Critical and Important severity qualify, on the most recent actively maintained branch; Moderate and Low findings pay $0 at every report quality This repository is not in the local-machine carve-out, so a finding whose only impact is on the machine already running the code is excluded Report quality moves the amount as much as severity does: the same Critical deserialization finding pays $15,000 written well and $6,000 written badly, so include the reproduction and the impact analysis Return an IRS tax form within 30 calendar days of validation, and expect sanctions screening against your country of residence before anything is paid Disclosure Coordinated through MSRC. Fixes for the Azure SDKs go out through the Microsoft Security Update Guide rather than as repository advisories, with the Maven Central release following once the fix ships. Because eligibility here turns on residency and Microsoft screens payees before it pays, file with MSRC yourself first and send sorona.xyz the case ID. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability