Vulnerability Response for Large Open Source Projects
summary
Describes a Grafana account takeover caused by trusting email from multi‑tenant Azure AD and the concrete fix to use provider immutable IDs, with reproduction steps, forensics, and mitigation instructions. Response includes account takeover via Azure AD multi-tenant email matching, private patching across patched six release lines, staged deployment in four rollout waves, and a CVSS of 9.4 (critical). Process changes: move from bug bounty to VDP, build a vulnerability observability plugin, and add AI‑assisted triage with human review.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:24Vulnerability handling foundations
- 5:34Discovery and triage
- 9:04Case analysis and report
- 12:36Impact and severity
- 16:50Mitigation and remediation
- 20:39CVE lifecycle and disclosure
- 22:24Post-disclosure improvements
- 23:49Rising vulnerability volume
- 25:12Key takeaways
- 25:32Q&A
related talks
33mFrom Chaos to Calm: Vulnerability Management for a Dynamic, Sprawling Technology Estate
51mAdvanced Attack Vectors in Azure Environments
14mThreat Modeling for O11y: From Blind Spots to Actionable Insight
49mAzure DevOps security - Lessons learned
38mAbusing Azure Active Directory: From MFA Bypass to Listing Global Administrators
55mAzure Attacks Unpacked: Real-World Threats & Lessons
52mUncovering Azure's Silent Threats: A Journey Into Cloud Vulnerabilities
42mAzure DevOps security - Lessons learned