Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

XSS Using Active Directory Automatic Provisioning

netspi.com | vulnerability | #cloud | #xss | #output-encoding | #azure-ad | #scim | #identity-management

Summary

Azure AD SCIM provisioning synced user names into a web app without output encoding, giving script injection via the firstName field and a path to steal credentials with an imported JS file.
Published
Collected

original ↗

Related coverage

blog · netspi.com
Targeting Passwords for Managed and Federated Microsoft Accounts
Releases Invoke-ExternalDomainBruteforce, which detects whether a Microsoft domain is managed or federated, picks the right authentication flow, and automates password guessing against O365 and ADFS.
blog · projectblack.io
Should I Azure AD Sync/Entra Cloud Sync Domain Admins?
Syncing Domain Admins into Entra ID lets attackers pivot from compromised on-prem AD to the cloud, and back via password writeback. CIS and Microsoft advise keeping privileged admin accounts cloud-only.
blog · semperis.com
Why On-Premises Active Directory Still Matters in a Cloud-Connected World
AD is not becoming obsolete—it is evolving. Sean Deuby explains Microsoft's 'One AD' vision joining on-prem AD DS and Azure AD, and why the 93% of Fortune 1000 still running AD keeps it central.
vulnerability · netspi.com
CVE-2026-78902: XSS to RCE in pfSense with one DNS request
NetSPI reports CVE-2026-78902, a stored cross-site scripting issue in the pfSense pfBlockerNG package that can be escalated to remote code execution with a single DNS request.
vulnerability · netspi.com
CVE-2024-37888 – CKEditor 4 Open Link plugin XSS
CVE-2024-37888 is an XSS in CKEditor 4's Open Link plugin that lets crafted hyperlinks execute JavaScript in a victim's browser. Found during a client engagement, it affects latest plugin versions.
vulnerability · netspi.com
CVE-2021-42306 CredManifest: App Registration Certificates Stored in Azure Active Directory
CVE-2021-42306 CredManifest: Azure Automation 'Run as' PFX certificates were stored in cleartext in Azure AD App Registration manifests, letting most AAD users authenticate as Contributors.
back