3 ms·

Did I misread the article, or is this not really saying anything? I think most comments here think that this means locally overriding policies leads to elevated

Did I misread the article, or is this not really saying anything? I think most comments here think that this means locally overriding policies leads to elevated access on the server, but what is demonstrated is only enabling certain UX features that are disabled per server side policy by lying to the client. For example, the video demonstrating "bypassing cloud storage restrictions" only enables the client side button to add providers other than SharePoint, but this has no effect serverside. Similarly, bypassing editing and deleting policies client side is shown but with no mention of whether this has any effect on the server or is just a cosmetic effect on the client. Another blog post could be written titled "I wrote my own teams client where I'm allowed to edit messages locally", would that be a security issue? In other words there is not really anything of note, if I read the post correctly.

prepend 6y ago
Seems like a surface hack that makes people think something bad happens. I hate these kinds of issues as they will prompt emails from non-technicals who think it’s a real threat.
chrismeller 6y ago
I’m even more confused. In the video I see him doing something completely different from what he says in the article. Neither the article nor the video prove that it does anything more than limit the display options client-side though. The source of truth is still the server and nothing here speaks to that...
geoelkh 6y ago
Agree. The backend tells you what is allowed and you override it and it shows that it is allowed now :) The real issue would have been if the user did these actions and there was no backend validations on them. The video does not cover this.
- ludjer 6y ago
  Yip I am struggling to see where the security risk is. If the policies are still applied server side(I am assuming this is the case since they did not demo server side vulnerabilities). Then all you are doing is getting to a part of the UI that has no functionality. The same can be done with many other UI's by editing the local configuration.
TwoBit 6y ago
The article is not saying that this is a security issue. It's saying that admin control of these policies is circumventable and so don’t depend on them. That's useful to know.
- jaywalk 6y ago
  But it seems like nothing actually depends on these policies except some cosmetic stuff in the client. So it's literally nothing.
- markandrewj 6y ago
  If you can't preform the action associated with the interface element, the policies are not circumvented though. Being able to see the interface elements, and being able to preform the action associated with the interface element, are different things.
nemetroid 6y ago
I think the introduction to the article describes something that's not just a UI thing: > While I was working with the previous version (v0.4.4) of AADInternals Teams functions I noticed an interesting thing: I was able to edit and delete chat messages using AADInternals as a guest even when it was not allowed. I agree however that the rest of the article doesn't really make any attempts to show a server-side issue.
- deleted 6y ago
  [deleted]
- oarsinsync 6y ago
  Exactly this. This is a situation where user input is only being sanitised client-side, not server-side. That's what's being (poorly) reported. In the unlikely event that someone reading this doesn't understand why server-side sanitation of any user input is always required, xkcd.com/327 provides an amusing take.
Groxx 6y ago
Yeah, this seems equivalent to "people who have rooted their phones can take secret screenshots of your snapchats!"... which is solidly on the "well yeah, obviously" side of the security-outrage boundary. If it does change server data, yea - significant news. But that doesn't seem to be implied, except by omission of a claim that it does not.
chmod775 6y ago
He claims there are no server-side checks, but fails to demonstrate that this is the case.
admax88q 6y ago
Unfortunately I feel like this is the new standard for security "researchers." Bug bounty programs and flashy brand name vulnerabilities have created this ecosystem where lots of security "researchers" publish long blog posts about so called "vulerabilities" they have discovered, hyping them up to be way more than they are. In hopes of getting bug bounties or hired as contractors I assume. I had to unsubscribe from reddit's r/netsec and r/blackhat due to the number of borderline false posts like this. There's like this intense pressure of people in security to network it seems. In the rare times I would post on netsec/blackhat to correct a misconception I'd get reached out to to connect on linkedin and whatnot. Of course there is still some tremendous security researchers out there, like those at Google ProjectZero, but this industry seems to also attract a lot of borderline grifters.
- tptacek 6y ago
  There's nothing at all new about marginal security researchers making mountains out of molehills; it's a time-honored tradition. But you're miscalibrated if your threshold for good researchers is P0. There's plenty of bounty randos doing tremendous work as well.
  - admax88q 6y ago
    I guess, personally it just feels like there is an uptick in security "researchers" making mountains out of molehills, or more common mountains out of literally nothing, such as this "vulerability." This is akin to saying fakeroot gives you root capabilities, or claiming to get root by doing "export PS1='# '" I never said P0 is my threshold, I just used them as an example of good security researchers. I don't doubt there are plenty of randos doing good work. I'm just finding the signal to noise ratio is getting worse.
lol768 6y ago
He's suggested on twitter the enabled client functions do actually work: https://twitter.com/NestoriSyynimaa/status/1321134686714953728 https://twitter.com/NestoriSyynimaa/status/13211346867149537... (But hasn't offered any evidence to back this up)

prepend 6y ago

Seems like a surface hack that makes people think something bad happens. I hate these kinds of issues as they will prompt emails from non-technicals who think it’s a real threat.

chrismeller 6y ago

I’m even more confused. In the video I see him doing something completely different from what he says in the article. Neither the article nor the video prove that it does anything more than limit the display options client-side though. The source of truth is still the server and nothing here speaks to that...

geoelkh 6y ago

Agree. The backend tells you what is allowed and you override it and it shows that it is allowed now :) The real issue would have been if the user did these actions and there was no backend validations on them. The video does not cover this.

ludjer 6y ago
Yip I am struggling to see where the security risk is. If the policies are still applied server side(I am assuming this is the case since they did not demo server side vulnerabilities). Then all you are doing is getting to a part of the UI that has no functionality. The same can be done with many other UI's by editing the local configuration.

TwoBit 6y ago

The article is not saying that this is a security issue. It's saying that admin control of these policies is circumventable and so don’t depend on them. That's useful to know.

jaywalk 6y ago
But it seems like nothing actually depends on these policies except some cosmetic stuff in the client. So it's literally nothing.
markandrewj 6y ago
If you can't preform the action associated with the interface element, the policies are not circumvented though. Being able to see the interface elements, and being able to preform the action associated with the interface element, are different things.

nemetroid 6y ago

I think the introduction to the article describes something that's not just a UI thing: > While I was working with the previous version (v0.4.4) of AADInternals Teams functions I noticed an interesting thing: I was able to edit and delete chat messages using AADInternals as a guest even when it was not allowed. I agree however that the rest of the article doesn't really make any attempts to show a server-side issue.

deleted 6y ago
[deleted]
oarsinsync 6y ago
Exactly this. This is a situation where user input is only being sanitised client-side, not server-side. That's what's being (poorly) reported. In the unlikely event that someone reading this doesn't understand why server-side sanitation of any user input is always required, xkcd.com/327 provides an amusing take.

Groxx 6y ago

Yeah, this seems equivalent to "people who have rooted their phones can take secret screenshots of your snapchats!"... which is solidly on the "well yeah, obviously" side of the security-outrage boundary. If it does change server data, yea - significant news. But that doesn't seem to be implied, except by omission of a claim that it does not.

chmod775 6y ago

He claims there are no server-side checks, but fails to demonstrate that this is the case.

admax88q 6y ago

Unfortunately I feel like this is the new standard for security "researchers." Bug bounty programs and flashy brand name vulnerabilities have created this ecosystem where lots of security "researchers" publish long blog posts about so called "vulerabilities" they have discovered, hyping them up to be way more than they are. In hopes of getting bug bounties or hired as contractors I assume. I had to unsubscribe from reddit's r/netsec and r/blackhat due to the number of borderline false posts like this. There's like this intense pressure of people in security to network it seems. In the rare times I would post on netsec/blackhat to correct a misconception I'd get reached out to to connect on linkedin and whatnot. Of course there is still some tremendous security researchers out there, like those at Google ProjectZero, but this industry seems to also attract a lot of borderline grifters.

tptacek 6y ago
There's nothing at all new about marginal security researchers making mountains out of molehills; it's a time-honored tradition. But you're miscalibrated if your threshold for good researchers is P0. There's plenty of bounty randos doing tremendous work as well.
- admax88q 6y ago
  I guess, personally it just feels like there is an uptick in security "researchers" making mountains out of molehills, or more common mountains out of literally nothing, such as this "vulerability." This is akin to saying fakeroot gives you root capabilities, or claiming to get root by doing "export PS1='# '" I never said P0 is my threshold, I just used them as an example of good security researchers. I don't doubt there are plenty of randos doing good work. I'm just finding the signal to noise ratio is getting worse.

lol768 6y ago

He's suggested on twitter the enabled client functions do actually work: https://twitter.com/NestoriSyynimaa/status/1321134686714953728 https://twitter.com/NestoriSyynimaa/status/13211346867149537... (But hasn't offered any evidence to back this up)