Entra ID Security Lücke gefixt

[NorbertFe 2.278]

https://www.heise.de/news/Entra-ID-Luecke-Angreifer-haetten-global-alle-Tenants-uebernehmen-koennen-10662375.html

https://www.golem.de/news/microsoft-hacker-konnten-wohl-beliebige-entra-id-tenants-kapern-2509-200233.html

 

und die Original Quelle (soweit ich das gesehen habe).

https://dirkjanm.io/obtaining-global-admin-in-every-entra-id-tenant-with-actor-tokens/

 

Klingt richtig toll ;)

Zitat

Effectively this means that with a token I requested in my lab tenant I could authenticate as any user, including Global Admins, in any other tenant. Because of the nature of these Actor tokens, they are not subject to security policies like Conditional Access, which means there was no setting that could have mitigated this for specific hardened tenants. Since the Azure AD Graph API is an older API for managing the core Azure AD / Entra ID service, access to this API could have been used to make any modification in the tenant that Global Admins can do, including taking over or creating new identities and granting them any permission in the tenant. With these compromised identities the access could also be extended to Microsoft 365 and Azure.