Microsoft Teams has a vulnerability that could see it being abused as a vector for delivering malware.
Security researchers at Jumpsec discovered a way to use the video conferencing software to inject malware into an organization's network from a Teams account that is outside of the organization in question.
Using default configurations, the attack leverages the ability of an organization's Microsoft Teams client to accept communications from ‘external tenants' – those using Teams accounts from outside the company.
External communications
The Jumpsec report notes that while this exploit can be used to perpetrate social engineering and phishing attacks, it can also be used to send malware payloads to another inbox, despite Teams having protections to block files coming from external tenants.
The researchers found a way to bypass these restrictions, by altering the recipient ID both internally and externally in the POST request of a message, tricking Teams into thinking an external account is actually internal.
During their tests, the researchers were able to successfully deliver a command and control payload into another organization's inbox, as part of a covert operation.
There is no need to bother with crafting a convincing phishing message to lure the victim, and if the threat actor were to register a domain similar to the target's, then it may fool workers into thinking the link came from within the company, and therefore safe to download.
After reporting the exploit to Microsoft, the tech giant responded that “it does not meet the bar for immediate servicing,” signifying the relatively low risk it thinks it poses. It has not yet confirmed when it will likely provide a patch.
Communication with external tenants can be disabled by navigating to the Microsoft Teams Admin Center and then to External Access. If you do not wish to block all external communications, then you can choose to communicate with trusted domains only by adding them to the allow list.
The researchers also submitted their findings to the Microsoft Teams feedback portal, where users can up-vote the post in the hope of pressing Microsoft to attend to the issue quicker.
English
Arabic
Belarusian
Bengali
Bosnian
Bulgarian
Chinese (Simplified)
Croatian
Czech
Danish
Dutch
Estonian
Filipino
Finnish
French
Georgian
German
Greek
Gujarati
Hausa
Hebrew
Hindi
Hmong
Hungarian
Igbo
Indonesian
Italian
Japanese
Javanese
Kazakh
Korean
Kurdish (Kurmanji)
Kyrgyz
Lao
Latvian
Lithuanian
Macedonian
Malagasy
Norwegian
Persian
Polish
Portuguese
Punjabi
Romanian
Russian
Serbian
Slovak
Slovenian
Spanish
Swedish
Thai
Turkish
Ukrainian
Vietnamese
Yoruba