Azure SDK for .NET

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical - deserialization of untrusted data or code injection, high-quality report │ $15,000 │ $16,000 Critical - authentication issues, improper access control, SSRF, or SQL and command injection │ $12,000 │ $13,000 Important - deserialization of untrusted data or code injection │ $10,000 │ $11,000 Critical - XSS, CSRF, cross-origin access, improper input validation, web misconfiguration │ $8,000 │ $9,000 Important - authentication issues, improper access control, SSRF, or SQL and command injection │ $6,000 │ $7,000 Critical - GitHub Actions in the repository │ $5,000 │ $6,000 Important - XSS, CSRF, cross-origin access, improper input validation, web misconfiguration │ $4,000 │ $5,000 Important - GitHub Actions in the repository │ $3,000 │ $3,750 Moderate and Low, every vulnerability type │ $0 │ $0 Submit a vulnerability CVE history 0 Last 12 months 4 Lifetime Auth bypass 30 % Info disclosure 25 % Injection 20 % Access control 20 % Latest advisories Loading the feed Overview Azure.Identity has 1.84 billion lifetime NuGet downloads and Azure.Storage.Blobs 730 million, and practically every .NET application deployed on Azure takes a dependency on this repository, usually through DefaultAzureCredential , the single most common authentication entry point in the Microsoft cloud. It runs in App Service, Azure Functions, AKS pods using workload identity, Windows services and developer laptops, and it is the code that decides which identity a process ends up assuming. Its CVE history is unusually identity-heavy for exactly that reason: three of the four known CVEs are in Azure.Identity , and CVE-2023-36414 was a straightforward code injection in credential handling. Note the ceiling carefully, this repository sits under the $15,000 Open Source Bounty Program rather than the $40,000 .NET program, so base class library defects route away from here. Microsoft pays through the MSRC Researcher Portal, and sorona.xyz adds 1.25x on top of whatever Microsoft awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope The whole of azure/azure-sdk-for-net , which the program names on its SCOPE list under "Azure SDKs, limited to the following", at Critical or Important severity on the most recent actively maintained branch Azure.Core : the HTTP pipeline and every policy on it, the response and serialization layer, and the tracing hooks each generated client inherits Azure.Identity : every credential type, DefaultAzureCredential and the chained credentials, managed and workload identity, the developer fallbacks, and the persisted token cache The generated data-plane clients across the whole catalogue, Azure.Storage.* , Key Vault, Cosmos, Service Bus, Event Hubs, App Configuration and the rest: request construction, URL and SAS handling, and response deserialization The Azure.ResourceManager.* control-plane clients, and the extension packages that wire the SDK into ASP.NET Core, Azure Functions and the Microsoft.Extensions hosting model The repository's own build, release and publish GitHub Actions workflows, which the program prices in a band of their own Out of scope .NET base class library defects, which route to the separate .NET bounty program at a different ceiling: a bug in System.Text.Json or System.Net.Http is not this program's Azure service-side defects, which route to the Azure bounty program Microsoft repositories outside the program's fifteen-entry SCOPE list: the standard SECURITY.md pointing at MSRC is a reporting path and funds nothing A defect already covered by another vendor's bounty program, which MSRC declines to pay for a second time Findings whose impact stays on the local machine, since this repository sits outside the carve-out Microsoft grants to VS Code, Agent Framework, TypeScript, Monaco Editor and PowerShell Moderate and Low severity, which pay $0 at every report quality Samples, tutorials, quickstart code and samples/ directories Hackathon repositories, dependency-confusion reports and publicly disclosed issues Reports Microsoft cannot pay out on: residency in a sanctioned country, or no IRS tax form returned within 30 days of validation, voids the award Most-valued findings Code injection in credential handling, the CVE-2023-36414 shape, where a value flowing through the credential chain ends up executed rather than merely parsed: this is the class carrying the $15,000 top band here A DefaultAzureCredential chain flaw that silently falls back to, or is steered into, an identity the application never intended to assume, which is the $12,000 authentication-issues band Token cache persistence that leaves an access or refresh token readable by another process or user on the same host Bearer-token challenge or redirect handling in Azure.Core that forwards an Azure token to an endpoint outside the intended resource SAS construction or URL and path parsing in Azure.Storage.* that yields access to a container, blob or path the caller never asked for Key Vault client certificate validation that accepts a chain it should reject, since that is the trust decision protecting the secrets the client is fetching Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. .NET base class library defects route to the separate .NET bounty program, and Azure service-side defects to the Azure program; only client-library code is paid here Only the repositories listed under "Azure SDKs, limited to the following" qualify; no other Azure repository is covered This repo is not in the local-machine carve-out, so local-machine-only impact is excluded Only Critical and Important severity qualify on the most recent actively maintained branch; Moderate and Low findings pay $0 Follow coordinated vulnerability disclosure: Microsoft requires bounty submissions stay confidential while it fixes, and imposing a fix deadline forfeits eligibility Return an IRS tax form (W-9, W-8BEN or 8233) within 30 calendar days of validation, and expect sanctions screening Disclosure Coordinated through MSRC. Azure SDK fixes are published through the Microsoft Security Update Guide rather than as repository advisories, with the NuGet advisory following once fixed packages ship. Microsoft requires bounty submissions stay confidential while it fixes, so file with MSRC yourself first, hold publication until the advisory lands, and send sorona.xyz the case ID. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability