Microsoft Teams: Vulnerability in Microsoft Power Apps Service Allows Theft of Emails, Files and More

A flaw in Microsoft Power Apps could allow attackers to steal emails, Teams messages and OneDrive files.

背景

Microsoft recently patched a vulnerability in Microsoft Teams, a business communication platform that has surged in popularity with the shift to a remote workforce, recording 145 million daily active users in April 2021. The vulnerability, which was discovered by Tenable Zero-day Researcher Evan Grant, could allow an attacker to take control of an end-user’s account. This could grant the attacker access to the victim’s chat history, the ability to read and send emails on the victim’s behalf, and access files in their OneDrive storage.

分析

Microsoft Teams has a default feature that allows users to launch applications as a tab within any team they belong to. Organizations using Office 365 or Microsoft Teams with a Business Basic license or higher can also launch Microsoft Power Apps within these tabs.

Tenable discovered that content loaded into these Power Apps tabs was governed by an improperly anchored regular expression. That is, the validation mechanism used to confirm that the content in the tab comes from a trusted source only verifies that a given URL begins with “https://make.powerapps.com” and does not validate any further. This means an attacker can simply create a subdomain of “make.powerapps.com” for any domain they control, such as https://make.powerapps.com.fakecorp.ca, which allows them to load untrusted content into a Power Apps tab.

The severity of this vulnerability is amplified by the permissions granted to Microsoft Power Apps within Microsoft Teams. Successful exploitation of this flaw allows attackers to take control of any users that access the malicious tab. This includes reading the victim users’ group messages within Teams, accessing the users’ email and OneDrive storage, and more.

概念验证

As this flaw is a server side vulnerability, Microsoft fixed the issue without any user action required. Because the issue has been patched, a proof-of-concept will not be released, however detailed information and a full analysis for this issue can be found on the Tenable Techblog. The following video demonstration shows how the flaw could have been abused:

Vendor response

Through our vulnerability disclosure policy, Tenable worked with Microsoft to review and address our findings. For details on the disclosure timeline, please refer to our corresponding Tenable Research Advisory.

解决方案

Microsoft implemented a solution to address this issue — no action is required from end-users or organizations.

获取更多信息

• Tenable Techblog Writeup
• Tenable Research Advisory TRA-2021-23
• Tenable Research Advisories

加入 Tenable Community 中的 Tenable 安全响应团队

了解有关 Tenable 这款首创 Cyber Exposure 平台的更多信息，全面管理现代攻击面。

获取 30 天免费试用 Tenable.io 漏洞管理平台的机会。