3 ms·
Cross Domain Authentication Bypass in Office 365
- chayesfss 11y agoOut of all the service providers I've worked with, microsoft's been the worst. Few years ago I was amazed that I could literally brute force an o365 admin account via powershell and it would never lock the account and of course there was no way to enable 2fa for the account...
- zaroth 11y agoThis is impressively bad. Literally Office365 let you simply claim to be anyone you wanted to via SAML. They didn't bother checking the user was actually in the same domain as the SAML Identity Provider. I can't get over how insanely incompetent that is...
- jc_811 11y agoI guess the only saving grace is that they fixed it in 7 hours, but again it shouldn't have been an issues in the first place :/