Microsoft Teams Bug Allowing Phishing Unpatched Since March

Microsoft said it won’t fix or is delaying patches for several security flaws impacting Microsoft Teams’ link preview feature reported since March 2021.

German IT security consultancy firm Positive Security’s co-founder Fabian Bräunlein discovered four vulnerabilities leading to Server-Side Request Forgery (SSRF), URL preview spoofing, IP address leak (Android), and denial of service (DoS) dubbed Message of Death (Android).

Bräunlein reported the four flaws to the Microsoft Security Response Center (MSRC), which investigates vulnerability reports concerning Microsoft products and services

Also Read: 5 Workplace Tips: Protecting Information on Mobile Devices

“The vulnerabilities allow accessing internal Microsoft services, spoofing the link preview, and, for Android users, leaking their IP address and DoS’ing their Teams app/channels,” the researcher said.

Out of the four vulnerabilities, Microsoft addressed only the one that attackers could use to gain access to targets’ IP addresses if they use Android devices.

Regarding the other bugs, Microsoft said they wouldn’t fix the SSRF in the current version, while a fix for the DoS will be considered in a future release.

Bug exposing users to phishing left unpatched

The URL preview spoofing bug that threat actors could use for phishing attacks or camouflage malicious links was tagged as not posing any danger to Teams users.

“MSRC has investigated this issue and concluded that this does not pose an immediate threat that requires urgent attention because once the user clicks on the URL, they would have to go to that malicious URL which would be a giveaway that it’s not the one the user was expecting,” Microsoft said.

Also Read: The Role of A DPO During Work From Home

“While the discovered vulnerabilities have a limited impact, it’s surprising both that such simple attack vectors have seemingly not been tested for before, and that Microsoft does not have the willingness or resources to protect their users from them,” the researchers added.https://player.vimeo.com/video/659403127

Video: Positive Security

The company’s decision not to address the spoofing bug which could be abused in phishing campaigns is partially explained by Teams also using Defender for Office 365 Safe Links protection to safeguard users from URL-based phishing attacks since July.

While Safe Links protection is available to all Teams users and works for links shared across conversations, group chats, and Teams channels, it still needs to be enabled by setting up a Safe Links policy in the Microsoft 365 Defender portal.