Azure tenant takeover via Microsoft application
Published Fri, Apr 26th, 2024
Platforms
Summary
A vulnerability in Microsoft Dynamics 365 Supply Chain Visibility allowed arbitrary takeover of Azure tenants via a malicious reply URL. Clicking a link could grant an attacker directory read access or full tenant control if clicked by a Global Admin, without requiring user consent.
Affected Services
Microsoft Entra ID, Microsoft Dynamics 365 Supply Chain Visibility
Remediation
None required
Tracked CVEs
No tracked CVEs
References
Contributed by https://github.com/mer-b
Entry Status
Finalized
Disclosure Date
Sat, Nov 18th, 2023
Exploitability Period
Until 2024/01/29
Known ITW Exploitation
-
Detection Methods
Monitor for unexpected additions of users to high-privilege roles like Global Administrator. Review sign-in logs for suspicious access from unfamiliar IP addresses or locations.
Piercing Index Rating
-
Discovered by
Arnau Ortega, FalconForce
