How An Image Could’ve Let Attackers Hack Microsoft Teams Accounts

Microsoft has patched a worm-like vulnerability in its Teams workplace video chat and collaboration platform that could have allowed attackers to take over an organization’s entire roster of Teams accounts just by sending participants a malicious link to an innocent-looking image.

The flaw, impacting both desktop and web versions of the app, was discovered by cybersecurity researchers at CyberArk. After the findings were responsibly disclosed on March 23, Microsoft patched the vulnerability in an update released on April 20.

“Even if an attacker doesn’t gather much information from a Teams’ account, they could still use the account to traverse throughout an organization (just like a worm),” CyberArk’s Omer Tsarfati said.

“Eventually, the attacker could access all the data from your organization’s Teams accounts — gathering confidential information, meetings and calendar information, competitive data, secrets, passwords, private information, business plans, etc.”

The development comes as video conferencing software such as Zoom and Microsoft Teams are witnessing an unprecedented surge in demand as businesses, students, and even government employees across the world are forced to work and socialize from home during the coronavirus pandemic.

A Subdomain Takeover Vulnerability

The flaw stems from the way Microsoft Teams handles authentication to image resources. Every time the app is opened, an access token, a JSON Web Token (JWT) is created during the process, allowing a user to view images shared by the individual or others in a conversation.