This Microsoft Entra ID Vulnerability Could Have Been Catastrophic

As in the neighborhood business The world has transferred to their digital infrastructure, starting from self-hosted server over the past decade CloudThey benefited from the quality of the main cloud suppliers, built -in security features MicrosoftThe However this system may have potential with so much riding Catastrophe If something goes wrong, it is huge. Case-in Point: Security researcher Dark-Jan Molma recently stumbled Vulnerable Microsoft Azur’s identity and access management platform that can be used for potential catastrophic techovers of all azur customer accounts.

Known as the Entra ID, the system stores the use of the use of the cloud customer, sign-in access control, applications and subscription management equipment to each Azure Cloud Customer’s user. Molma has studied the entra ID protection in depth and has published multiple studies about the weakness in the system, formerly known as Active Directory in Azur. But time to prepare Present At the Black Hat Security Conference in Las Vegas in July, Molma discovered two weaknesses that he realized that the benefits of global administrators – basically to compromise on the GOD Shobar Mode – and to compromise in each entra ID director, or “tenant” he could compromise. Molma says that it probably revealed almost every entra ID tenant in the world, except the government cloud infrastructure.

“I just looked at my screen. I was, ‘No, it wouldn’t really happen,’ Molma said, who operates the external protection of the Dutch CyberCsis Company and specialized in the cloud protection. “It was pretty bad. As bad as it is, I’ll say.”

Molma added, “From my own tenants – my test tenant or even a trial rental – you can request these tokens and you can basically disguise someone else,” Molma added. “This means you can correct the configuration of another guy, make new and administrators users in that tenant and do something as you like” “

Due to the seriousness of weakness, Molma published his search at the Microsoft Protection Response Center on July 14, on the same day of discovering his errors. Microsoft launched investigations that day and issued a fix worldwide on July 7. The company confirmed to Molma that the matter was determined by July 25 and additional measures were implemented in August. Microsoft Issued a CVE September 4 for weakness.

“We have quickly alleviated the newly marked issue,” said Tom Galga, Vice President of Engineering at Microsoft’s Protection Response Center and accelerated the ongoing remedy to cancel the use of this legacy protocol as part of our protected future initiative. ” “We have implemented a code change in the vulnerable validation logic, tested the fix and applied it across our cloud ecosystem.”

Galgar says that Microsoft could not find “any evidence of abuse” during the investigation.

Both weaknesses are still related to the legacy systems that work in the Enter ID. In the first one of the kind of azure authentication token is known as the actor token, which is issued by an obscure azure process called “Access Control Service”. The actor has some special systems features of the tokens that Molma realized that an attacker could be effective if it was combined with another weakness. The other bug was a major error in the Active Directory application programming interface of a Historic Tihasik azur, known as “Graph”, used to facilitate access to data stored in Microsoft 365. The active directory graph in Microsoft azur is under the process of retirement and the users are under the process of converting to their successors, Microsoft Graphs, which are designed for Entra ID. The error was related to the failure of the advertisement of azure azur to verify a Azure tenant to verify that the manipulated could be done so that the API would take a token from a different tenant which would have to be rejected.