Summary
Descope identified a possible misconfiguration in Azure AD which could lead to misuse of the "Log in with Microsoft"
authentication method on a web app. If an application relies on email attribute claims for authentication (which is
against best practice) and also merges user accounts without proper validation, an attacker could falsify an email
claim to gain full control over the target account. Descope and Microsoft Microsoft identified several popular multi-tenant
applications with users that used an email address with an unverified domain owner, which would therefore be vulnerable
to this type of takeover. Following disclosure, Microsoft deployed mitigations to omit token claims from unverified
domain owners for most applications.
Affected Services
Azure AD
Remediation
None required
Tracked CVEs
No tracked CVEs
References
https://msrc.microsoft.com/blog/2023/06/potential-risk-of-privilege-escalation-in-azure-ad-applications/https://www.descope.com/blog/post/noauth
Contributed by https://github.com/korniko98
Entry Status
Finalized
Disclosure Date
Tue, Apr 11th, 2023
Exploitablity Period
-
Known ITW Exploitation
-
Detection Methods
-
Piercing Index Rating
-
Discovered by
Descope
