Coding Gaffe Exposes Microsoft 365 Accounts to Widespread Takeover
A coding error in several Microsoft 365 Android applications, specifically Excel, Word, PowerPoint, OneNote, Loop, and Microsoft 365 Copilot, exposed user accounts to potential compromise. The issue stemmed from a disabled security setting that allowed unauthorized apps to request authentication tokens, enabling attackers to steal login credentials and access data across the Microsoft 365 ecosystem. Microsoft has released updates to address the vulnerabilities, highlighting the critical importance of secure coding practices and robust authentication token management.
A vulnerability was discovered in the Android versions of Microsoft 365 applications due to a coding oversight. The core issue was a debug setting that was inadvertently left enabled in production releases. This setting, designed to prevent other apps from accessing authentication tokens, was disabled, creating a pathway for malicious applications to obtain user login credentials. Researchers at Enclave identified that any Android app capable of requesting a token could potentially gain access to Microsoft authentication credentials, allowing for the replication of data across multiple Microsoft apps. This included the ability to read email messages, Teams messages, and open files.