Wormable, Zero-Click Vulnerability in Microsoft Teams

guest · Dec 8, 2020

Wormable, Zero-Click Vulnerability in Microsoft Teams
December 7, 2020
https://www.securityweek.com/wormable-zero-click-vulnerability-microsoft-teams

Vegeris, a security engineer at Evolution Gaming, warned that a novel cross-site scripting (XSS) vulnerability at the ‘teams.microsoft.com’ domain could be abused to trigger a remote code execution flaw in the Microsoft Teams desktop application.

According to an advisory published by Vegeris, an attacker simply needs to send a specially crafted message to any Teams user or channel to launch a successful exploit that runs silently in the background, without the user noticing anything.

“Remote Code Execution has been achieved in desktop applications across all supported platforms (Windows, macOS, Linux). Code execution gives attackers full access to victim devices and company internal networks via those devices,” Vegeris warned.
Click to expand...

On top of that, the vulnerability is wormable, allowing a successful attacker to automatically send the exploit payload to other users/channels, also without interaction.
Click to expand...

guest · Dec 9, 2020

mood said: ↑

Wormable, Zero-Click Vulnerability in Microsoft Teams December 7, 2020
Click to expand...

Update:

“We mitigated the issue with an update in October, which has automatically deployed and protected customers,” a Microsoft spokesperson said, responding to a SecurityWeek inquiry.

*updated with statement from Microsoft
Click to expand...

Security experts say Microsoft downplayed the severity of a Teams hack
December 9, 2020
https://www.inputmag.com/culture/se...osoft-downplayed-the-severity-of-a-teams-hack

Microsoft is under scrutiny in the cybersecurity community for potentially trivializing the nature and risk of a recent hacking incident. In a GitHub post, security researcher Oskars Vegaris demonstrated, with accompanying screengrabs, how hackers exploited a vulnerability within Microsoft Teams to remotely inject the platform with a privacy-breaching bug.

The firm claimed that it did not make users aware of the vulnerability on grounds that these security patches for Teams are automatically installed. Potentially understating the severity of the remote code execution (RCE) bug is troublesome, Vegaris warned.
Click to expand...

Security experts are frustrated with Microsoft's approach because Teams is used by numerous organizations, companies, and individuals, from students and small businesses, to major corporations. A bug of this magnitude could adversely affect them all, and any other entity that uses Teams.

THE BACKGROUND — Microsoft categorized the issue as "Important, Spoofing" but Vegaris wrote on GitHub that the classification downplayed the urgency of the problem as this particular tag is "one of the lowest in-scope ratings possible."
Click to expand...

"At least now we have a new joke between colleagues," Vegaris wrote. "Whenever we get a remote code execution bug, we call it 'Important, Spoofing.' Thanks, Microsoft."
Click to expand...

Log in or Sign up

Wormable, Zero-Click Vulnerability in Microsoft Teams

guest Guest

guest Guest

Log in or Sign up

Wormable, Zero-Click Vulnerability in Microsoft Teams

guest Guest

guest Guest

Useful Searches