3 ms·
And just recently Sharepoint was found to accept alg: null JWT tokens (ie. complete authentication bypass)
by formerly_proven 3y ago
And just recently Sharepoint was found to accept alg: null JWT tokens (ie. complete authentication bypass)
- ipython 3y agoDo you have a link to a cve or vuln report? I’d like to read more
- formerly_proven 3y agohttps://starlabs.sg/blog/2023/09-sharepoint-pre-auth-rce-chain/ https://starlabs.sg/blog/2023/09-sharepoint-pre-auth-rce-cha...
- formerly_proven 3y agoYou also have things like mimikatz - which is only a thing because Windows just stores user's passwords in plaintext in lsass memory -, pathetically weak hashes, pass the hash etc. Catastrophically-bad-by-design authentication is a Microsoft staple.