Azure AD Vulnerability Leaks Credentials, Lets Attackers Deploy Malicious Apps
An ASP.NET Core appsettings.json file containing Azure Active Directory (Azure AD) credentials was discovered to be exposed during a recent cybersecurity assessment. This exposure poses a critical risk, providing potential attackers with access to an…
An ASP.NET Core appsettings.json file containing Azure Active Directory (Azure AD) credentials was discovered to be exposed during a recent cybersecurity assessment. This exposure poses a critical risk, providing potential attackers with access to an organization's cloud environment.
Researchers identified that a publicly accessible appsettings.json file contained the ClientId and ClientSecret of an Azure AD application. This allowed unauthorized entities to authenticate against Microsoft’s OAuth 2.0 endpoints, effectively posing as a trusted application.
The exposure of ClientId and ClientSecret enables attackers to request OAuth 2.0 tokens through the Client Credentials flow. This results in a Bearer token granting access to Microsoft Graph APIs, which can lead to:
Access to sensitive data in SharePoint, OneDrive, and Exchange Online Enumeration of users, groups, and directory roles in Azure AD Abuse of Graph API calls for privilege escalation or persistence Deployment of malicious applications within the tenant
The lack of access controls on the file allows for easy harvesting of these secrets by automated scans or determined adversaries, leading to potential data compromise and lateral movement within cloud services.
This exposure poses a critical risk, providing potential attackers with access to an organization's cloud environment.
This vulnerability highlights typical misconfigurations and inadequate secrets management in cloud-native applications. Developers often store sensitive information such as ClientId, ClientSecret, storage keys, or database passwords in plain configuration files. Issues arise when:
Servers are configured to serve static files, unintentionally exposing JSON configurations. Deployment pipelines transfer internal configuration files to production without access restrictions. Secrets are hardcoded, bypassing secure vaults like Azure Key Vault or AWS Secrets Manager. Regular security testing or code reviews are absent, leading to unnoticed exposed files. There is an overreliance on secrecy, neglecting automated crawling tools.
In ASP.NET Core applications, appsettings.json is a primary configuration file storing connection strings, API keys, cloud credentials, logging settings, and more. When publicly accessible, these values can be exploited by adversaries to impersonate legitimate applications.
Token Acquisition: Attackers can submit a POST request to Azure AD’s /oauth2/v2.0/token endpoint with the leaked credentials to obtain a Bearer token. User Enumeration: Using the token, attackers can list all tenant users via the GET https://graph.microsoft.com/v1.0/users endpoint, obtaining user details. Permission Grants: The GET https://graph.microsoft.com/v1.0/oauth2PermissionGrants endpoint reveals permissions held by the compromised app. Group Enumeration: The GET https://graph.microsoft.com/v1.0/groups endpoint exposes organizational groups, identifying high-privilege targets.
These capabilities enable attackers to exfiltrate data, escalate privileges, register unauthorized applications, and manipulate cloud resources.
To mitigate such risks, organizations should enforce strict file-access controls, avoid public hosting of configuration files, and implement robust secret management practices. Transitioning secrets to secure vaults, integrating automated scanning for exposed credentials, conducting regular penetration tests, and enforcing least-privilege Graph permissions are crucial steps in reducing vulnerability.
Based on reporting by GBHackers.