Azure B2C 0-Day: An Exploit Chain from Public Keys to Microsoft Bug Bounty
John Novak details an exploit chain in Microsoft Azure AD B2C, recovering signing keys to forge administrative tokens across customer tenants and the MSRC portal.
Summary
Azure Active Directory B2C Architecture
Microsoft Azure AD B2C provides customer-facing identity and access management for thousands of global enterprises, government agencies, and the Microsoft Security Response Center (MSRC).
Discovering Cryptographic Misuse in Token Generation
John Novak investigates the cryptographic token issuance flows in Azure B2C, identifying flawed key derivation routines that leak critical cryptographic material.
Recovering Private Keys and Forging Arbitrary Claims
Novel algebraic cryptanalysis enables recovering the internal token-signing keys, allowing an unauthenticated attacker to mint valid administrative JWTs for any tenant.
Full Tenant Compromise and MSRC Impact
Demonstrating the full exploit chain against the live MSRC bug bounty portal illustrates how an attacker could have accessed unpatched Microsoft vulnerability reports.
Related talks
Main Stage·24 min
Sharon Brizinov · Tal Skverer
Tal Skverer details GhostToken, a critical zero-day vulnerability in Google Cloud Platform allowing third-party OAuth apps to become invisible and unremovable.
Main Stage·29 min
Ben Sadeghipour
Demonstrates how SSRF vulnerabilities provide a direct path from web application to cloud metadata service, IAM credentials, and full account compromise.
Cloud Village·32 min
Gautam Peri
Dangling issuer vulnerabilities in federated cloud credentials and how to exploit them.