Security researchers have discovered four separate vulnerabilities in Microsoft Teams (opens in new tab) that could be exploited by an attacker to spoof link previews, leak IP addresses and even access the software giant's internal services.
These discoveries were made by researchers at Positive Security (opens in new tab) who “stumbled upon” them while looking for a way to bypass the the Same-Origin Policy (SOP) in Teams and Electron according to a new blog post (opens in new tab). For those unfamiliar, SOP is a security mechanism found in browsers (opens in new tab) that helps stop websites from attacking one another.
During their investigation into the matter, the researchers found that they could bypass the SOP in Teams by abusing the link preview (opens in new tab) feature in Microsoft's video conferencing software (opens in new tab) by allowing the client to generate a link preview for the target page and then using either summary text or optical character recognition (OCR (opens in new tab)) on the preview image to extract information.
However, while doing this, Positive Security co-founder Fabian Bräunlein found other unrelated vulnerabilities in the feature's implementation.
Microsoft Teams vulnerabilities
Of the four bugs Bräunlein found in Teams, two can be used on any device and allow for server-side request forgery (SSRF) and spoofing while the other two only affect Android smartphones (opens in new tab) and can be exploited to leak IP addresses and achieve Denial of Service (DOS).
By exploiting the SSRF vulnerability, the researchers were able to leak information from Microsoft's local network. Meanwhile the spoofing bug can be used to improve the effectiveness of phishing attacks or to hide malicious links (opens in new tab).
The DOS bug is particularly worrying as an attacker can send a user a message that includes a link preview with an invalid preview link target (for instance “boom” instead of “https://...”) to crash the Teams app for Android. Unfortunately, the app will continue to crash when trying to open the chat or channel with the malicious message.
Positive Security responsibly disclosed its findings to Microsoft on March 10 through its bug bounty program (opens in new tab). However, in the time since, the software giant has only patched the IP address leak vulnerability in Teams for Android. Now that Positive Security has publicly disclosed its findings, Microsoft may have to patch the remaining three vulnerabilities even though it told the researchers that they don't pose an immediate threat to its users.
Via Threatpost (opens in new tab)