While investigating this issue, researchers discovered that the Teams SOP could be circumvented by abusing the link preview feature of Microsoft’s video conferencing software. This allows the client to generate link previews for landing pages, generate summary text or visuals, and extract information using character recognition (OCR) on preview images. But in doing so, Fabian Bräunlein, co-founder of Positive Security, discovered another separate vulnerability in the feature’s implementation.
Security researchers have identified four separate vulnerabilities in Microsoft Teams that attackers could exploit to forge link previews, leak IP addresses, and access internal services of the software giant. I found
These findings were made by Positive Security researchers while looking for ways to bypass the Same Origin Policy (SOP) in Teams and Electron, according to a new blog post. For those unfamiliar, SOP is a browser security mechanism that helps prevent websites from attacking each other.
Highlights
-
DOS bugs are of particular concern. An attacker could crash the Teams app for Android by sending a user a message containing a preview link with an invalid preview link target. Unfortunately the app keeps crashing when I try to open a chat or channel with a malicious message. Microsoft responsibly disclosed its findings on March 10th through its bug bounty program. In the meantime, however, the software giant has only patched his IP address leak vulnerability in Teams for Android. Now that Positive Security has published its findings, Microsoft may need to patch his three remaining vulnerabilities, but they don’t pose an immediate threat to users, the researchers told researchers.
-
Microsoft Teams vulnerabilities. Of the four bugs Bräunlein discovered in Teams, two can be used on any device and allow server-side request forgery (SSRF) and spoofing, while the other two only affect Android phones. , can be exploited to leak IP addresses or achieve denial of service (DOS). By exploiting the SSRF vulnerability, the researcher was able to leak information from his Microsoft local network. Spoofing bugs, on the other hand, can be used to make phishing attacks more effective or hide malicious links.