Tackling the Recent Rise of Cross-Tenant Vulnerabilities
summary
Researchers demonstrate more than 10 recent critical cross-tenant flaws and reproduce three real chains: a PostgreSQL compromise that leads to arbitrary code, a container escape that lets attackers access other tenants’ containers on Alibaba ApsaraDB, an Azure case where shared network plus a forged SSL cert yields full read of other tenants’ Postgres databases, and an IBM chain: overprivileged service account → registry creds → forgotten secret → CI/CD write access. They publish the PEACH framework and CloudVulnDB; vendors fix the issues.
AI-written summary · about
chapters (12)
- 0:00Introduction to cross-tenant risks
- 3:38What is multitenancy
- 5:04Cross-tenant vulnerabilities explained
- 7:16Logical separation approach
- 9:03Container-based isolation
- 11:36VM-based isolation model
- 13:45Beyond compute isolation
- 15:10Azure PostgreSQL case study
- 17:25IBM managed database attack
- 26:01Introducing the PEACH framework
- 32:47Key takeaways and recommendations
- 35:20Q&A session
related talks
40mBreaking Managed Data Services in the Cloud
22mDevSecOps - The Story of 3 Security Breaches
41mCloud-Wide Contamination: Chaining SSRFs for Tenant Compromise in Azure (CVE-2025-29972)
33mIn the Trenches During a Software Supply Chain Attack
46mStories from the cutting edge: Cloud security in 2023
46mApplication security from start to finish
52mUncovering Azure's Silent Threats: A Journey Into Cloud Vulnerabilities
32mDo This, Not That – Lessons from 7 Headline Grabbing Security Breaches