Azure Blob Storage
Azure Blob Storage exposes data when a container's "Public access level" is set to `blob` (anonymous read of individual blobs) or `container` (anonymous read plus enumerate). The latter is the more dangerous default.
Azure Blob Storage exposure data
Aggregate figures only. See the full open-buckets data across all providers.
Common misconfiguration class
Azure's container-level toggle predates the account-wide "allow blob anonymous access" switch (rolled out 2022). Storage accounts created before that point default to allowing anonymous access, a setting that has to be explicitly disabled even if no container uses it.
Real-world impact
Container-level anonymous access returns a full XML list of blobs at `https://<account>.blob.core.windows.net/<container>?restype=container&comp=list`. Each blob is then individually downloadable.
Remediation
- Disable "Allow Blob anonymous access" at the storage-account level.
- Set every container's public access level to `Private` unless it's a CDN origin.
- Use SAS tokens for time-bounded sharing instead of permanent anonymous reads.
URL patterns
Azure Blob Storage buckets typically resolve under hostnames like:
example.blob.core.windows.net/container/example.blob.core.windows.net/container?restype=container&comp=list
Check a specific Azure Blob Storage URL
Paste any Azure Blob Storage URL into our free Open Viewer to inspect its contents directly in your browser, no signup needed.
Open the ViewerOwn a listed Azure Blob Storage bucket?
If a bucket you operate appears in our index and you have remediated the misconfiguration, submit a takedown request and we'll remove it from public listings within 4 hours.
Submit takedown request