New OAuth Attack Lets Hackers Bypass Microsoft Entra Authentication and Steal Keys

Cybersecurity: Microsoft Entra ID Vulnerability Exploitation

Researchers have identified a novel attack vector, termed "ConsentFix," targeting Microsoft Entra ID. This vector exploits OAuth 2.0 authentication flows to gain unauthorized access to privileged tokens. The attack bypasses device compliance checks and Conditional Access policies by manipulating the authorization code flow in Microsoft applications.

The attack targets native public applications like the Microsoft Azure CLI. It begins when a target visits a malicious website, triggering a legitimate Microsoft Entra login URI. This URI targets the "Microsoft Azure CLI" application and the "Azure Resource Manager" resource, initiating the OAuth 2.0 authorization code flow. Typically, this flow involves the application setting up a listener to receive authentication responses. However, in the ConsentFix attack, no application listens on localhost, causing a browser error. The attacker then manipulates the user into providing the sensitive authorization code through actions like drag-and-drop.

Once the code is obtained, the attacker redeems it to acquire access tokens, ID tokens, and potentially refresh tokens, enabling access to Azure Resource Manager and other resources.

Successful attacks leave traces in Entra ID sign-in logs, marked by two events: an initial interactive sign-in by the victim and a subsequent non-interactive sign-in from the attacker's infrastructure. To detect such attacks, events with matching SessionId, ApplicationId, and UserId should be correlated, with the second event occurring within ten minutes of the first. Legitimate usage typically shows both sign-ins from the same IP address, whereas attacks show geographic dispersion.

The vulnerability extends to multiple applications accepting localhost redirects, including Microsoft Azure PowerShell, Visual Studio, and MS Teams PowerShell Cmdlets.

Organizations can adopt various defensive strategies:

Require explicit user assignment for service principals to limit attack vectors, demanding identification of legitimate CLI users. Implement Conditional Access policies to block CLI tool access, requiring baseline analysis in report-only mode. Utilize Microsoft Entra ID's Token Protection feature, which requires proof-of-possession, neutralizing ConsentFix attacks.

Broader protection can involve Global Secure Access with compliant network checks to block token issuance using stolen refresh tokens. However, this does not prevent initial code redemption.

Organizations must audit sign-in patterns for anomalies, enforce user assignment controls, and evaluate Token Protection readiness to mitigate risks effectively.

Based on reporting by GBHackers.