Researchers at JUMPSEC recently discovered a vulnerability in the security of Microsoft Teams. They tricked the system into thinking the malware was a file instead of a link by bypassing client-side controls. In this blog, we will cover the following:

1. What happened?

2. How researchers exploited IDOR in teams?

3. Microsoft’s response

4. Recommendation

5. How Akto can help?

Microsoft Teams Security Alert: What happened?

A recent advisory from JUMPSEC Labs has uncovered a dangerous vulnerability in the latest version of Microsoft Teams. Researchers Max Corbridge and Tom Ellson discovered an IDOR vulnerability that could allow malware to be introduced to a user's system. They found that the default Microsoft Teams configuration bypassed client-side security controls, enabling attackers to deliver malware via maliciously crafted files to target users.

"Microsoft Teams is the ultimate messaging app for your organization – a workspace for real-time collaboration and communication, meetings, file and app sharing. As of 2023, Microsoft Teams had 280 million daily active users. In 2022, the annual revenue of Microsoft Corporation was 198.27 billion." Read more here.

Users with a Microsoft account can connect with businesses or organizations using Microsoft Teams, known as external tenancies. Each external tenancy has its own Microsoft tenancy, and users from one tenancy can send messages to users in another. The name of the external tenancy is accompanied by an "External" banner when sending messages.

"IDOR (Insecure Direct Object Reference) vulnerability is a type of security vulnerability that occurs when an application allows unauthorized access to an object by modifying the value of a parameter used to directly reference that object. This can occur when an application fails to properly enforce access controls or properly validate user input." Read More here.

External messages often come with a warning, but people still click on them. This lets attackers send malware to the target. Researchers at JUMPSEC found a way around Microsoft Teams' security. They tricked the system into thinking the malware was a file instead of a link. This can fool most anti-phishing measures and is very dangerous for organizations.

How researchers exploited IDOR in teams?

Sending files to staff in another organization is not allowed, unlike with members of your own tenancy. See the below image.

But the JUMPSEC researchers found a way to get past security controls by using a traditional IDOR technique. They changed the IDs of the internal and external recipients on the POST request, which is usually located at /v1/users/ME/conversations/messages.

Also, the malware that's hosted on a SharePoint domain looks like a file to the victim user instead of a link. So, the target user is likely to download the malware without being warned.

The payload is hosted on a SharePoint domain and downloaded from there by the target, but it is disguised as a file rather than a link in the target's inbox.