{"id":1109,"date":"2020-12-08T12:06:06","date_gmt":"2020-12-08T12:06:06","guid":{"rendered":"http:\/\/zerothcode.com\/blog\/?p=1109"},"modified":"2020-12-08T12:06:06","modified_gmt":"2020-12-08T12:06:06","slug":"zero-click-wormable-rce-vulnerability-reported-microsoft-teams","status":"publish","type":"post","link":"https:\/\/zerothcode.com\/blog\/zero-click-wormable-rce-vulnerability-reported-microsoft-teams\/","title":{"rendered":"Zero-Click Wormable RCE Vulnerability Reported in Microsoft Teams"},"content":{"rendered":"

Vulnerability A zero-click remote code execution (RCE) bug in Microsoft Teams desktop apps could have allowed<\/p>\n

an adversary to execute arbitrary code by merely sending a specially-crafted chat message and compromise a target’s system.<\/p>\n

The issues were reported to the Windows maker by Oskars Vegeris, a security engineer from Evolution<\/p>\n

Gaming, on August 31, 2020, before they were addressed at the end of October.<\/p>\n

“No user interaction is required, exploit executes upon seeing the chat message,”<\/p>\n

Vegeris explained in a technical write-up. Vulnerability<\/h4>\n

The result is a “complete loss of confidentiality and integrity for end-users<\/p>\n

\u2014 access to private chats, files, internal network, private keys, and personal data outside MS Teams,<\/p>\n

” the researcher added.<\/p>\n

Worse, the RCE is cross-platform \u2014 affecting Microsoft Teams for Windows (v1.3.00.21759),<\/p>\n

Linux (v1.3.00.16851), macOS (v1.3.00.23764),<\/p>\n

and the web (teams.microsoft.com) \u2014 and could be made wormable,<\/p>\n

meaning it could be propagated by automatically reposting the malicious payload to other channels.<\/p>\n

This also means the exploit can be passed on from one account to a whole group of users,<\/p>\n

thereby compromising an entire channel.<\/p>\n

\"\"<\/a><\/div>\n

To achieve this, the exploit chain strings together a cross-site scripting (XSS) flaw present in the Teams ‘@mentions’ functionality<\/p>\n

and a JavaScript-based RCE payload to post a harmless-looking chat message containing<\/p>\n

a user mention either in the form of a direct message or to a channel.<\/p>\n

Simply visiting the chat at the recipient’s end leads to the execution of the payload,<\/p>\n

allowing it to be exploited to log users’ SSO tokens to local storage for exfiltration<\/p>\n

and execute any command of the attacker’s choice.<\/p>\n

This is not the first time such RCE flaws were observed in Teams and other enterprise-focused messaging apps.<\/p>\n

Chief among them is a separate RCE vulnerability in Microsoft Teams (CVE-2020-17091)<\/p>\n

that the company patched as part of its November 2020 Patch Tuesday last month.<\/p>\n

Earlier this August, Vegeris also disclosed a critical “wormable” flaw in Slack’s desktop version<\/p>\n

that could have allowed an attacker to take over the system by simply sending a malicious file to another Slack user.<\/p>\n

Then in September,<\/p>\n

networking equipment maker Cisco patched a similar flaw in its Jabber video conferencing and messaging app for Windows that,<\/p>\n

if exploited, could allow an authenticated, remote attacker to execute arbitrary code.<\/p>\n","protected":false},"excerpt":{"rendered":"

Vulnerability A zero-click remote code execution (RCE) bug in Microsoft Teams desktop apps could have allowed an adversary to execute<\/p>\n","protected":false},"author":1,"featured_media":1110,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[37],"tags":[],"yst_prominent_words":[1156,65,320,352,427,1213,386,496,180,967],"class_list":["post-1109","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hackers-news"],"_links":{"self":[{"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/posts\/1109","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/comments?post=1109"}],"version-history":[{"count":0,"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/posts\/1109\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/media\/1110"}],"wp:attachment":[{"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/media?parent=1109"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/categories?post=1109"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/tags?post=1109"},{"taxonomy":"yst_prominent_words","embeddable":true,"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/yst_prominent_words?post=1109"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}