Cross-Tenant Request Forgery Attack in Multi-Tenancy Environments
summary
Claim: an attacker can use public identifiers and naive OAuth flows to make one customer’s integration act for another customer and read or modify their data. Evidence includes working patterns against 2LO via Client Credential or JWT bearer, the unsafe installation_id callback and public tenant IDs in Azure AD and Github, and manual workarounds like domain-wide delegation or shared key URLs. Built proofs include documented misbindings, vendor reports to Microsoft, and recommended fixes: require secrets, verify bindings via 3LO, or use per-tenant keys.
AI-written summary · about
chapters (10)
- 0:00Introduction and speakers
- 1:39OAuth and authorization
- 4:59Three-legged vs two-legged
- 7:56Multi-tenant client risks
- 14:03GitHub case study
- 17:23Azure AD and Octa vulnerabilities
- 24:18Mitigation strategies
- 27:58Platform implementation examples
- 32:49Reporting and conclusions
- 36:26Q&A session
related talks
33mBreaking Tokens: Modern Attacks on OAuth, OIDC, and JWT Auth Flows
30mFederated Login CSRF
38mAbusing Azure Active Directory: From MFA Bypass to Listing Global Administrators
23mUniversal Cross-app Attacks: Exploiting and Securing OAuth 2.0 in...
09mThe dark art of OIDC abuse - A case study in Entra ID
37mPreventing Authentication Bypass: A Tale of Two Researchers
33mYour Identity Is Mine: Techniques & Insights From OS Identity Providers Research
22mLearn to Navigate the Perils and Pitfalls of Multi-Tenant Identity...