Saturday, April 13, 2024

Microsoft Teams Chat Service Bug Let Hackers Gain Read/Write Access to a Victim User’s Teams Chats

Cybersecurity researcher Evan Grant of the security firm Tenable has recently detected a vulnerability in the Microsoft Teams. And this vulnerability allows the threat actor to take control of the account of users.

By exploiting this flaw hackers can easily steal all the sensitive data like:-

  • User’s Teams messages
  • Emails
  • One Drive files

Apart from this, the threat actors can also send emails and messages to disguise themselves as the users so that they can trick their victims easily; but, luckily this vulnerability has been patched.

Malicious Microsoft Teams Tab

This feature is one of the default features of Microsoft Teams, and the security researcher Evan Grant affirmed that the threat actors are taking the advantage of this default key feature.

Microsoft Teams Tab feature enables the users to initiate small apps as a tab from the team they belong to, and this feature is applicable for all the users.

Here the power apps are the subset of the wider Microsoft Power Platform, and the main motive of initiating power apps is to store, manage and share team-specific data, apps, and flows. 

But the hackers are miserably abusing this default environment for their own benefits and privileges.

Thieving Tokens

All the power tabs are not built for equal purposes, but, Evan Grant claimed that the power App extension tab types, the page generally interacts with both of its teams, “Teams JS SDK” and “Child iFrame,” here just by using the javascript postMessage it communicates.

During an investigation, Grant remarked that the frame which was being replaced is getting access to the tokens from its parent window, and the most important part is that it doesn’t require any further authentication. 

Through this, the hackers are getting access to the tokens without any issue, since it doesn’t require any authentication to pass through.

Stealing more tokens, emails, messages, and files

Grant pronounced that, tokens are taking more attention, as they can be easily abused by the threat actors to get access to more such tokens.

Once the threat actors get access to the tokens they can easily create a Power Automate flows, which would later allow them to get access to the user’s email from Outlook, files from OneDrive and SharePoint, Team messages, and many more.

Pieces of a PoC 

  • Office 365 (for Outlook access), and Teams connectors,
  • Flow that allows them to send emails as the user.
  • Flow that allows them to get all Teams messages from channels the victim is in and to send messages on their behalf.


Moreover, one can carry out this attack, if he/she is a member of the Microsoft Teams; and this implies that this is a context of insider threat attack.

However, this attack can put a potential impact on the users and could be huge, especially if the motive of the threat actors is to hit an organization administrator.


Latest articles

Alert! Palo Alto RCE Zero-day Vulnerability Actively Exploited in the Wild

In a recent security bulletin, Palo Alto Networks disclosed a critical vulnerability in its...

6-year-old Lighttpd Flaw Impacts Intel And Lenovo Servers

The software supply chain is filled with various challenges, such as untracked security vulnerabilities...

Hackers Employ Deepfake Technology To Impersonate as LastPass CEO

A LastPass employee recently became the target of an attempted fraud involving sophisticated audio...

Sisence Data Breach, CISA Urges To Reset Login Credentials

In response to a recent data breach at Sisense, a provider of data analytics...

DuckDuckGo Launches Privacy Pro: 3-in-1 service With VPN

DuckDuckGo has launched Privacy Pro, a new subscription service that promises to enhance user...

Cyber Attack Surge by 28%:Education Sector at High Risk

In Q1 2024, Check Point Research (CPR) witnessed a notable increase in the average...

Midnight Blizzard’s Microsoft Corporate Email Hack Threatens Federal Agencies: CISA Warns

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive concerning a...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Top 3 SME Attack Vectors

Securing the Top 3 SME Attack Vectors

Cybercriminals are laying siege to small-to-medium enterprises (SMEs) across sectors. 73% of SMEs know they were breached in 2023. The real rate could be closer to 100%.

  • Stolen credentials
  • Phishing
  • Exploitation of vulnerabilities

Related Articles