Security researchers have discovered four separate vulnerabilities in Microsoft Teams that could be exploited by an attacker to spoof link previews, leak IP addresses and even access the software giant’s internal services.
These discoveries were made by researchers at Positive Security who “stumbled upon” them while looking for a way to bypass the the Same-Origin Policy (SOP) in Teams and Electron according to a new blog post. For those unfamiliar, SOP is a security mechanism found in browsers that helps stop websites from attacking one another.
During their investigation into the matter, the researchers found that they could bypass the SOP in Teams by abusing the link preview feature in Microsoft’s video conferencing software by allowing the client to generate a link preview for the target page and then using either summary text or optical character recognition (OCR) on the preview image to extract information.
However, while doing this, Positive Security co-founder Fabian Bräunlein found other unrelated vulnerabilities in the feature’s implementation.
Microsoft Teams vulnerabilities
Of the four bugs Bräunlein found in Teams, two can be used on any device and allow for server-side request forgery (SSRF) and spoofing while the other two only affect Android smartphones and can be exploited to leak IP addresses and achieve Denial of Service (DOS).
By exploiting the SSRF vulnerability, the researchers were able to leak information from Microsoft’s local network. Meanwhile the spoofing bug can be used to improve the effectiveness of phishing attacks or to hide malicious links.
The DOS bug is particularly worrying as an attacker can send a user a message that includes a link preview with an invalid preview link target (for instance “boom” instead of “https://…”) to crash the Teams app for Android. Unfortunately, the app will continue to crash when trying to open the chat or channel with the malicious message.
Positive Security responsibly disclosed its findings to Microsoft on March 10 through its bug bounty program. However, in the time since, the software giant has only patched the IP address leak vulnerability in Teams for Android. Now that Positive Security has publicly disclosed its findings, Microsoft may have to patch the remaining three vulnerabilities even though it told the researchers that they don’t pose an immediate threat to its users.
We’ve also rounded up the best identity theft protection, best firewall and best malware removal software
Via Threatpost