Actor Authentication Tokens Provided Worldwide Admin Access Throughout Azure Entra ID Tenants
We independently review everything we recommend. When you buy through our links, we may earn a commission which is paid directly to our Australia-based writers, editors, and support staff. Thank you for your support!
Brief Overview
- A severe flaw in Microsoft Entra ID was uncovered, impacting global admin access throughout Azure tenants.
- The issue related to the handling of legacy authentication tokens and was resolved by Microsoft.
- Actor tokens enabled cross-tenant access, circumventing security protocols like Conditional Access.
- The outdated Azure AD Graph API’s interface lacked adequate validation and logging for audits.
- This vulnerability could spread across organizations due to Azure B2B guest accounts.
Unveiling a Severe Vulnerability
A researcher from the Netherlands, Dirk-jan Mollema, disclosed a serious flaw in Microsoft Entra ID, potentially granting attackers the ability to compromise global admin access across all Azure tenants globally. This discovery represents a pivotal moment in cybersecurity, emphasizing the threats related to legacy authentication token handling.
Grasping the Vulnerability
The vulnerability, identified by Mollema in July 2023, consisted of undocumented impersonation tokens and a defect in the Azure Active Directory Graph API. These tokens, essential for communication among backend services, evaded security protocols like Conditional Access, leading to possible exploitation.
Effects on Global Admins and Organizations
This flaw allowed attackers to authenticate as any user, including Global Admins, across various tenants. Such superuser accounts are vital for managing Entra ID tenants, and their compromise could result in severe security breaches, including the establishment of new identities and permissions.
The outdated Azure AD Graph API lacked thorough audit logging, complicating administrators’ efforts to identify suspicious activities. This vulnerability broadened access to Microsoft 365 and Azure, creating further security risks.
Risk of Propagation and Organizational Trust
The potential for widespread propagation of the vulnerability was concerning. Organizations employing Azure business-to-business guest accounts could inadvertently enable cross-tenant attacks, as attackers could mimic guest users in their native tenants.
“The information necessary to compromise most tenants worldwide could have been collected in a matter of minutes using a single Actor token,” Mollema remarked.
Conclusion
The identification of this critical vulnerability highlights the necessity for strong security protocols and frequent audits of legacy systems. Although Microsoft has rectified the problem, this event serves as a clear reminder of the constantly changing landscape of cybersecurity threats.