Cybersecurity consultant exposes Microsoft Teams flaws allowing reverse shell creation via GIFs

guest · Sep 9, 2022

By Sharron Bennet - September 8, 2022

There are “insecure” design elements or vulnerabilities within Microsoft Teams that could possibly be used by attackers. According to cybersecurity consultant Bobby Rauch who shared the discovery, it could be performed using the malicious GIFs sent in Teams messages. (via BleepingComputer)
Click to expand...

“This unique C2 infrastructure can be leveraged by sophisticated threat actors to avoid detection by EDR and other network monitoring tools. Particularly in secure network environments, where Microsoft Teams might be one of a handful of allowed, trusted hosts and programs, this attack chain can be particularly devastating,” explained Raunch.

“Two additional vulnerabilities discovered in Microsoft Teams, a lack of permission enforcement and attachment spoofing, allow for the GIFShell stager to be convincingly dropped and executed on the victim’s machine, completing the attack chain from victim compromise to covert communications.”
Click to expand...

The report was first shared with Microsoft in May and June of 2022. It concerns Teams Version 1.5.00.11163 and earlier, and Raunch said the vulnerabilities are still unpatched in the latest Teams version, giving the actors the chance to perform the GIFShell attack chain on them.

Raunch enumerated in his report the seven Microsoft Teams flaws and vulnerabilities. One of the most notable points highlighted by Raunch is the fact that the byte content of HTML base64 encoded GIFs included in Microsoft Teams messages are not scanned for malicious content.
Click to expand...

On the other hand, while Microsoft considers Raunch’s findings as part of “some lower severity vulnerabilities that don’t pose an immediate risk to customers,” it “will be considered for the next version or release of Windows.”
Click to expand...

GIFShell” — Covert Attack Chain and C2 Utilizing Microsoft Teams GIFs

By Bobby Rauch - August 24, 2022
Seven different insecure design elements/vulnerabilities present in Microsoft Teams, can be leveraged by an attacker, to execute a reverse shell between an attacker and victim, where no communication is directly exchanged between an attacker and a victim, but is entirely piped through malicious GIFs sent in Teams messages, and Out of Bounds (OOB) lookups of GIFs conducted by Microsoft’s own servers.
Click to expand...

Log in or Sign up

Cybersecurity consultant exposes Microsoft Teams flaws allowing reverse shell creation via GIFs

guest Guest

Log in or Sign up

Cybersecurity consultant exposes Microsoft Teams flaws allowing reverse shell creation via GIFs

guest Guest

Useful Searches