Preventing Authentication Bypass: A Tale of Two Researchers
summary
An internal Outlook endpoint returns an unsigned JWT with "alg":"none" that contains an oid, smtp and tenant id; replaying that token in REST calls lets one read and send mail for any account in the same tenant, and on consumer accounts the shared tenant id plus a trick using only the email address removes the need to enumerate UUIDs. Hunters find it via a JWT Attacker plugin and interception, Microsoft disables the endpoint immediately, reroutes search, issues a token-service fix and pays increased bounties.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:56First discovery
- 11:30Final result
- 12:30The discovery
- 20:27Microsofts response
- 28:02Developers Perspective
- 30:45Cloud Service Providers Perspective
- 36:49Resources
related talks
47mThe Storm-0558 Attack - Inside Microsoft Identity Security's Response
10mChasing Unicorns: A Lovable Security Story
33mYour Identity Is Mine: Techniques & Insights From OS Identity Providers Research
51mCross-Tenant Request Forgery Attack in Multi-Tenancy Environments
33mBreaking Tokens: Modern Attacks on OAuth, OIDC, and JWT Auth Flows
31mThe Hacker's Guide to JWT Security
25mHandling JWTs: Understanding Common Pitfalls
41mTales of OAuth2/OIDC in the wild