How can Entra OAuth misconfigs expose internal apps?

TL;DR

Entra ID OAuth misconfigurations can allow a user to obtain access tokens for internal Microsoft applications. The presenter demonstrates how consent prompts, multi-tenant flows, and improper token handling can lead to access beyond a user’s expected scope. Proper checks and tenant isolation are essential to prevent such exposure.

Transcript

Good afternoon everybody and welcome to my talk consent and compromise app using entra oath for fun and access to internal Microsoft applications. My name is Visha Bernard. I'm the chief hacker and co-founder of I security. We've existed for five years. We started with the five of us. Now I have around 200 employees. As chief hacker that means that... Read More

Key Insights

• Entra ID handles authentication via OIDC and authorization via OAuth, which together control access to resources.
• Consent prompts can be exploited when multi-tenant applications are involved, allowing tokens to be issued in a tenant different from where the app is registered.
• A service principle (enterprise application) can exist in multiple tenants, enabling cross-tenant access if not properly restricted.
• Multi-tenant and personal account support introduces complexity that can lead to token misissuance if endpoints and scopes are not validated.
• Vulnerabilities from past research, such as Bing Bang, informed improvements but residual risks remain with misconfigurations.
• The audience is reminded that apps registered in one tenant can be used by users from another tenant under certain consent flows.
• Authorization checks must verify the actual resource tenant and registered app to prevent token misuse.
• Security teams should audit app registrations and consent configurations to minimize exposure.

Questions & Answers

Q: What is the core vulnerability described in the talk?

The core vulnerability is a misconfiguration in Entra OAuth that can allow a user to obtain an access token for internal Microsoft applications through consent prompts and multi-tenant flows. This enables access to internal services that should be restricted to specific tenants and personnel. The talk explains how a consumer could be redirected to internal resources via the resource tenant and still receive a valid token, which highlights the need for stricter consent checks and tenant isolation.

Q: How does Entra ID perform authentication versus authorization?

Entra ID performs authentication using the OIDC protocol, which results in an ID token, and authorization using OAuth, which results in an access token. The processes are typically part of the same flow, especially in single page apps using the authorization code flow. Understanding the separation helps explain where misconfigurations can occur, such as token claims not being validated properly or consent prompts bypassing intended restrictions.

Q: What role do consent prompts play in the vulnerability?

Consent prompts determine whether a user or tenant approves an application to access certain data. In a misconfigured multi-tenant scenario, consent can be granted in a tenant where the app is not fully trusted, potentially allowing tokens to be issued that grant access to resources across tenants. The talk describes how an attacker might programmatically grant consent in bulk to trigger token issuance, illustrating a path to access internal applications.

Q: What is a service principal and how does it relate to the risk?

A service principal represents an application’s identity within a tenant. In multi-tenant configurations, the service principal can exist in multiple tenants, enabling access to resources across tenants if not properly restricted. This relationship is central to the risk because tokens tied to a service principal in one tenant could be used to access resources in another tenant if consent and endpoint validation are not correctly enforced.

Q: What is the Bing Bang reference about in the talk?

The Bing Bang reference recalls a 2023 vulnerability presented by another researcher showing that multi-tenant applications could be tricked into issuing tokens from a resource tenant when the attacker redirected authentication to a different tenant. This historical context underscores that multi-tenant exposure remains a concern and influenced Microsoft’s mitigations to stop cross-tenant token issuance.

Q: Why is multi-tenant support a security concern?

Multi-tenant support is a security concern because it enables users from one tenant to interact with apps registered in another tenant. If endpoints, scopes, and consent checks are not validated correctly, tokens may be issued appropriately for a different tenant, granting unintended access to internal applications and data. Proper checks must distinguish between resource tenants and registered tenants to prevent misissuance.

Q: What mitigation practices are suggested by the talk?

Mitigation practices include implementing strict authorization checks to verify the resource tenant and the registered app, reducing multi-tenant exposure, and ensuring consent prompts are properly enforced. Auditing app registrations, consent configurations, and token endpoints is also recommended to minimize exposure. These steps help ensure that tokens issued in one tenant cannot be reliably used to access resources in another.

Q: What kinds of internal Microsoft applications were mentioned as being at risk?

The talk states that over 20 internal Microsoft applications could be accessed, including internal portals and tools such as the Microsoft Engineering Hub and other internal services meant for Microsoft use. The exact names are not exhaustively listed, but the implication is that a single compromised consent flow could grant access across multiple internal resources, emphasizing the breadth of potential exposure.

Summary & Key Takeaways

• A misconfiguration in Entra OAuth can let a user access internal Microsoft applications by abusing consent prompts and multi-tenant behavior, revealing sensitive data and internal portals.

• The talk connects authentication and authorization flows with token issuance, highlighting how improper configuration can bridge a user to internal resources.

• Mitigation involves stricter consent handling, tenant awareness, and proper authorization checks to prevent cross-tenant token issuance.