The dark art of OIDC abuse - A case study in Entra ID
summary
Claims an OIDC flaw in Azure DevOps where the subject parameter sent by user is accepted by a weird serviceendpointendpointproxy request, letting an attacker spoof any service connection. Using Burp to intercept requests and combining that spoof with an SSRF, the researcher forces Azure DevOps to send an Entra ID service principal access token to an attacker-controlled server, enabling privilege escalation from a low-privileged service connection to takeover. Microsoft fixes the subject spoof in ~45 days, but SSRF vectors remain.
AI-written summary · about
related talks
58mPrivilege Escalation in Microsoft Azure
38mHiding in the Clouds: Abusing Azure DevOps Services to Bypass Microsoft Sentinel Analytic Rules
53mOAuth2/OIDC security weaknesses and pitfalls
42mSeeing Through the Fog: Interpreting Entra ID Signals During AiTM Attacks
41mTales of OAuth2/OIDC in the wild
26mTechnical Tracks
33mYour Identity Is Mine: Techniques & Insights From OS Identity Providers Research
51mCross-Tenant Request Forgery Attack in Multi-Tenancy Environments