GraphNinja

Summary

A vulnerability in Microsoft Graph allowed attackers to conduct password-spray attacks without detection. The issue involved switching the 'common' authentication endpoint with that of an unrelated tenant, thereby avoiding the appearance of logon attempts in the victim's logs. This technique could allow attackers to validate user credentials through verbose error messages, but actual successful logons using these credentials would still be recorded in the victims' logs (regardless of endpoint).

Affected Services

Microsoft Graph

Remediation

None required

Tracked CVEs

No tracked CVEs

References

Contributed by https://github.com/mer-b