Three trivial bugs in Microsoft Teams Software remain unpatched

Researchers disclosed four vulnerabilities in the Teams business communication software, but Microsoft will not address three of them.

Researchers from cybersecurity firm Positive Security discovered four vulnerabilities in the Teams business communication software that could allow accessing internal Microsoft services, spoofing the link preview, and, for Android users, leaking their IP address, and triggering a DoS condition on their Teams app/channels.

The vulnerabilities reside in the Microsoft Team link preview feature, experts reported them to Microsoft in March 2021, but the company will not fix three of them.

Microsoft only addressed a vulnerability that can lead to the leak of the IP address from Android devices, the company also explained that it will address the DoS flaw in a future version of the software.

The first bug is a server-side request forgery (SSRF) issue vulnerability in the endpoint “/urlp/v1/url/info,” an attacker can exploit it to reconnaissance of Microsoft’s local network.

“The URL is not filtered, leading to a limited SSRF (response time, code, size and open graph data leaked), which can be used for internal portscanning and sending HTTP-based exploits to the discovered web services.” reads the analysis of the experts.

A closer look at the link preview revealed a spoofing vulnerability, experts noticed that the preview link target can be set to any location independent of the main link, preview image and description, the displayed hostname or on-hover text.

This means that when clicking the preview, a different link is opened than what was expected by the user, exposing the recipient to phishing attacks.

The third flaw discovered by the researchers is a DoS vulnerability that affects the Android version of the popular software. The vulnerability can be triggered by sending a message with a specially crafted link preview containing an invalid target instead of a legitimate URL, this will cause the crash of the app.

The fourth vulnerability is an IP address leak as reported by the researchers:

“When creating a link preview, the backend fetches the referenced preview thumbnail and makes it available from a Microsoft domain. This ensures that the IP address and user agent data is not leaked when the receiving client loads the thumbnail. However, by intercepting the sending of the message, it’s possible to point the thumbnail URL to a non-Microsoft domain.” reads the analysis. “The Android client does not check the domain/does not have a CSP restricting the allowed domains and loads the thumbnail image from any domain.”

The experts pointed out that the flaws have a limited impact, but they expressed their surprise in finding so trivial attack vectors unpatched.

“While the discovered vulnerabilities have a limited impact, it’s surprising both that such simple attack vectors have seemingly not been tested for before, and that Microsoft does not have the willingness or resources to protect their users from them.” concludes the report.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, Microsoft Teams)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.