Microsoft Defender Vulnerabilities Allow Attackers to Bypass Authentication and Upload Malicious Files
Critical vulnerabilities have been identified within the network communication of Microsoft Defender for Endpoint (DFE) and its cloud services. These flaws enable attackers to potentially bypass authentication, spoof data, disclose sensitive information,…
Critical vulnerabilities have been identified within the network communication of Microsoft Defender for Endpoint (DFE) and its cloud services. These flaws enable attackers to potentially bypass authentication, spoof data, disclose sensitive information, and upload malicious files into investigation packages post-breach.
These vulnerabilities, outlined in a report from InfoGuard Labs, present ongoing risks within endpoint detection and response (EDR) systems, potentially affecting incident response procedures.
Reported to Microsoft’s Security Response Center (MSRC) in Jul 2025, these issues were categorized as low severity. As of Oct 2025, no fixes have been confirmed.
The research highlights issues in the interaction between the agent and cloud backends, particularly focusing on the MsSense.exe process. Using tools like Burp Suite and memory patches in WinDbg, researchers intercepted traffic and bypassed certificate pinning, allowing for inspection of HTTPS traffic.
Certificate pinning was circumvented by modifying the CRYPT32!CertVerifyCertificateChainPolicy function to always return a valid result, enabling plaintext traffic inspection. Similar techniques were applied to the SenseIR.exe process, allowing for full traffic interception, including Azure Blob uploads.
Critical vulnerabilities have been identified within the network communication of Microsoft Defender for Endpoint (DFE) and its cloud services.
Authentication Bypasses and Command Interception
The core vulnerability lies in the agent's communication with endpoints like https://[location-specific-host]/edr/commands/cnc, which handles commands such as isolation and forensics collection. Despite including authorization tokens, the backend does not validate them, allowing attackers to impersonate the agent and intercept responses with minimal credentials.
Intruder tools can continuously query these endpoints, capturing commands before legitimate agents process them. This can result in spoofing responses, such as falsely reporting a device as isolated when it is not.
Issues also affect /senseir/v1/actions/ endpoints for Live Response and Automated Investigations, where CloudLR tokens are similarly not verified. Attackers can decode action payloads using custom scripts and upload falsified data to Azure Blob URIs, retaining access for extended periods.
Information Disclosure and Malicious File Risks
Unauthenticated access also extends to incident response exclusions via a registration endpoint, requiring only the organization ID. Polling /edr/commands/cnc can yield an 8MB configuration dump revealing detection logic, which could be exploited for evasion.
Attackers may enumerate investigation packages on the filesystem, accessible to any user, containing critical data like autoruns and network connections. Malicious files with innocuous names could be embedded into these packages, misleading analysts during investigations.
These vulnerabilities highlight the challenges in securing EDR communications. The report urges immediate remediation, noting that post-breach disruption and targeted attacks against analysts warrant higher priority than currently assessed.
Based on reporting by Cyber Security News.