From Feature to Weapon: Breaking Microsoft Teams and SharePoint
Dr. Nestori Syynimaa abuses SharePoint Online migration APIs to tamper with files, inject stored XSS, and escalate privileges across Microsoft Teams and Azure AD.
Summary
SharePoint Online as Universal Enterprise Storage
Microsoft SharePoint Online (SPO) serves as the foundational file repository for Microsoft 365, powering backend document management for Teams channels, OneDrive, and Office Groups.
Abusing Granular Migration APIs
Dr. Nestori Syynimaa audits Microsoft migration utilities (Migration Manager and SPMT), discovering that their underlying REST APIs lack strict tenant-level integrity verification.
Tampering with Shared Files and Injecting Stored XSS
An unprivileged tenant user can leverage migration endpoints to overwrite existing documents, forge file creation timestamps, and inject malicious scripts into SharePoint lists.
Cross-Service Privilege Escalation to Azure AD
Triggering stored XSS within Microsoft Teams and SharePoint execution contexts enables stealing administrative access tokens, leading to full tenant elevation of privilege in Azure Active Directory.
Related talks
Main Stage·46 min
Bill Demirkapi
Demonstrates cross-tenant attacks and persistent firmware backdooring in major bare-metal cloud providers by exploiting legacy Baseboard Management Controllers.
Main Stage·39 min
David Cash · Rich Warren
Discloses a critical vulnerability in cloud-managed enterprise VPN platforms that allowed unauthenticated administrative takeover across thousands of corporate networks.
Main Stage·39 min
David Cash · Rich Warren
Reveals an architectural vulnerability in cloud-managed enterprise VPNs that allowed unauthenticated administrative takeover and network pivoting across corporate tenants.