Revisiting the Azure Kudu XSS: what Microsoft saidTen years on, the email thread behind the Azure Kudu XSS is more interesting than the bug. A look at the disclosure, why MSRC kept rejecting it, and why they were wrong.
An Azure zero-day XSS with sandbox escapeChaining a command injection into a stored XSS that jumps from a compromised SaaS site to the Azure administrator through the Kudu console.