Summary
A vulnerability in Microsoft Graph allowed attackers to conduct password-spray attacks without detection.
The issue involved switching the 'common' authentication endpoint with that of an unrelated tenant,
thereby avoiding the appearance of logon attempts in the victim's logs.
This technique could allow attackers to validate user credentials through verbose error messages,
but actual successful logons using these credentials would still be recorded in the victims' logs (regardless of endpoint).
Affected Services
Microsoft Graph
Remediation
None required
Tracked CVEs
No tracked CVEs
References
Contributed by https://github.com/mer-b
Disclosure Date
-
Exploitablity Period
June 2023 - March 2024
Known ITW Exploitation
-
Detection Methods
-
Piercing Index Rating
-
Discovered by
Nyx Geek, TrustedSec
