Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Bypassing Microsoft Entra Conditional Access Policies via Nested App Authentication

netspi.com | blog | #oauth | #conditional-access | #msrc | #bypass | #persistence | #microsoft-entra | #graph-api

Summary

NetSPI discovered Nested App Authentication (BroCI) flows that bypass Entra Conditional Access policies to mint Graph API tokens, mainly a post-phishing persistence vector; Microsoft has fixed it.
Published
Collected

original ↗

Related coverage

research · semperis.com
UnOAuthorized: Privilege Elevation Through Microsoft Applications
Semperis found Microsoft app permissions in Entra ID could act beyond intended authorization—even adding users to Global Administrator. Fixed via MSRC; covers detecting prior abuse and hardening.
blog · netspi.com
Azure VM Command Execution using Third-Party Extensions – Salt Minion
With the extensions/write permission, an attacker can deploy the Salt Minion extension pointed at a rogue Salt Master and push arbitrary states to an Azure VM as root over ZeroMQ ports 4505/4506.
blog · netspi.com
Azure VM Command Execution using Third-Party Extensions – Chef
With extensions/write, an attacker can point the Chef extension at a rogue Chef server for stealthy command execution and persistence on Azure VMs disguised as routine configuration management.
blog · netspi.com
Backdooring Azure Automation Account Packages and Runtime Environments
Custom PowerShell modules and Python packages in Azure Automation Accounts can be backdoored for persistence. NetSPI demonstrates the attack and ships a tool to audit custom modules.
blog · netspi.com
Mistaken Identity: Extracting Managed Identity Credentials from Azure Function Apps
Azure Function Apps leak Managed Identity certificates via encrypted startup contexts whose decryption key sits in environment variables, enabling attacker persistence; Microsoft has fixed it.
blog · netspi.com
Abusing Entra ID Misconfigurations to Bypass MFA
NetSPI describes an MFA bypass found in an external assessment: an Entra ID Conditional Access misconfiguration with Duo let attackers reuse an SSO token without any MFA prompt.
back