Critical Microsoft 365 Flaw Lets Attackers Bypass MFA, Hijack Sessions

Key Takeaways

• A critical vulnerability in Microsoft 365 allowed attackers to bypass multi-factor authentication (MFA) and hijack user sessions.
• The flaw, tracked as CVE-2023-38182, affected Microsoft SharePoint and was due to an insecure deserialization vulnerability.
• Successful exploitation granted attackers full control over compromised accounts, even with MFA enabled.
• Microsoft addressed the vulnerability in its October 2023 Patch Tuesday updates.
• Organizations must invalidate active sessions, audit OAuth permissions, and implement FIDO2 keys and Continuous Access Evaluation to mitigate risks.

Critical Microsoft 365 Flaw Bypassed MFA, Enabled Session Hijacking

A severe security vulnerability within Microsoft 365 enabled threat actors to circumvent multi-factor authentication (MFA) protocols and seize control of active user sessions. This critical flaw, identified as CVE-2023-38182, was publicly disclosed by Microsoft and patched during its October 2023 Patch Tuesday cycle. The vulnerability specifically impacted Microsoft SharePoint and stemmed from an insecure deserialization weakness, posing a significant risk to enterprise security.

Technical Details of CVE-2023-38182

The vulnerability, rated with a CVSS score of 7.5 (High), allowed an authenticated attacker to execute arbitrary code remotely by sending a specially crafted API request to an affected SharePoint server. While initial authentication was required, the subsequent exploitation of this flaw permitted attackers to bypass MFA mechanisms and hijack existing sessions, effectively granting them full control over the compromised user accounts. The nature of the deserialization vulnerability meant that malicious data embedded within legitimate-looking requests could be processed by the server, leading to unauthorized actions.

Security researchers at Varonis Threat Labs were credited with discovering and reporting this critical vulnerability. Their analysis revealed that the flaw could be exploited even when robust security measures like MFA were in place, highlighting a significant blind spot in an organization’s defense against sophisticated phishing and session hijacking attacks. Further details on the vulnerability were presented by Varonis at the Black Hat Europe 2023 conference, emphasizing the severity and potential impact on Microsoft 365 environments.

Exploitation and Impact

Successful exploitation of CVE-2023-38182 would allow an attacker to gain persistent access to a victim’s Microsoft 365 session. This means that even if a user had completed MFA to log in, an attacker could steal the session token and impersonate the legitimate user without needing to re-authenticate or bypass MFA again. The implications are severe, as attackers could then access sensitive data, send emails, manipulate documents, and perform any action the compromised user was authorized to do within the Microsoft 365 ecosystem.

Varonis researchers detailed the attack chain, which typically began with a phishing attempt to initially compromise user credentials. Once an attacker gained initial access, they could then leverage CVE-2023-38182 to elevate privileges, bypass MFA, and sustain access through session hijacking. This technique renders standard password resets ineffective for remediation, as existing session tokens remain valid until they are explicitly terminated by an administrator or expire naturally.

Indicators of Compromise (IoCs)

Organizations should monitor for specific indicators that may suggest exploitation of this vulnerability. Key web requests to look for include patterns matching /<three-letter-code>/xls/*.js, with canonical endpoints such as /api/xls/a1p2i.js. Additionally, the establishment of outbound WebSockets immediately following the retrieval of such scripts could be a strong indicator of compromise. Proactive monitoring for these patterns can assist security teams in detecting and responding to potential attacks.

What You Should Do

• Apply Updates Immediately: Ensure all Microsoft SharePoint servers and Microsoft 365 tenants are fully updated with the October 2023 Patch Tuesday security fixes and all subsequent updates.
• Invalidate All Active Sessions: As standard password resets are insufficient, security teams must immediately invalidate all active user sessions and refresh tokens across their Microsoft 365 tenants.
• Audit OAuth Permissions: Conduct a thorough audit of all tenant OAuth permissions to identify and revoke any suspicious or unnecessary application access.
• Enforce FIDO2 Hardware Security Keys: Implement and enforce the use of FIDO2 hardware security keys for MFA, as these are more resilient against sophisticated phishing and session hijacking attacks.
• Enable Continuous Access Evaluation (CAE): Activate Continuous Access Evaluation (CAE) within Microsoft Entra ID (formerly Azure Active Directory) to help neutralize stolen session cookies by revoking access in real-time based on policy changes or suspicious activity.
• Strengthen Phishing Defenses: Reinforce security awareness training for employees to recognize and report sophisticated phishing attempts, which often serve as the initial vector for such attacks.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.