All You Need is Guest
summary
Azure AD guest accounts can abuse Power Platform connections that business users share org‑wide to harvest credentials and call API Management proxies, yielding full SQL dumps, SharePoint files and KeyVault secrets. The chain uses an undocumented token exchange between Microsoft client‑ID families (Azure CLI as a public client) to mint API‑Hub tokens and replay requests. A released proof‑of‑concept called poweron automates enumeration, dumping and a SQL playground for arbitrary queries. Microsoft fixes and mitigations are underway; scale is large (5M .NET devs vs ~8M business users).
AI-written summary · about
chapters (11)
- 0:00Guest access in Microsoft tenants
- 1:07Guest access mechanisms
- 3:13Guest access provisioning
- 6:44Guest access permissions reality
- 8:32Guest access credential exploits
- 12:28Low-code applications by business users
- 18:55Bypassing Power Platform controls
- 24:32Programmatic access to API Hub and token generation
- 29:29Dumping shared credentials data
- 32:19Defending against guest exploits
- 37:14Summary and call to action
related talks
49mAll You Need Is Guest
55mOffensive Azure Security
51mAdvanced Attack Vectors in Azure Environments
38mAbusing Azure Active Directory: From MFA Bypass to Listing Global Administrators
58mPrivilege Escalation in Microsoft Azure
40mWhat’s Old is New: Hybrid Security for Microsoft Azure and On-Premises Tech
50mHybrid Active Directory Attacks: Anatomy and Defenses
45mFrom Subscription to Backdoor Intruder