Target Industry

Indiscriminate, opportunistic targeting.

Overview

A significant vulnerability in Microsoft’s OneDrive File Picker allows websites to access a user’s entire cloud storage. the OneDrive File Picker vulnerability is caused by the way it handles OAuth (Open Authentication) permissions.  

Impact

The severity of the impact from the OneDrive File Picker vulnerability on an organisation depends on the sensitivity or confidentiality of the data stored in OneDrive and the number of third-party applications integrated with OneDrive. 

If the data stored in OneDrive includes financial records or personal health information, the consequences of exposure are more severe. Similarly, the more integrated these applications are, the higher the risk of unauthorised access and data breaches. 

Affected Products

Microsoft products: 

• OneDrive File Picker versions 6.0 – 7.2 

• OneDrive File Picker Version 8.0.  Even though this is the latest version, 8.0 stores OAuth tokens in session storage in plain text, making them vulnerable to unauthorised access. 

Third party products: 

• ChatGPT 

• Slack 

• Trello 

• ClickUp 

• Phenome 

Exploitation

Instead of requesting specific, limited access to only the files a user wants to upload or share, the picker asks for broad permissions like Files.Read.All or Files.ReadWrite.All. These permissions grant access to the user’s entire OneDrive storage, not just the selected files. 

Containment, Mitigations & Remediations

To mitigate the OneDrive File Picker vulnerability, it is highly recommended to: 

• Regularly check and review the permissions granted to third-party applications integrated with OneDrive. Revoke access for apps that request overly broad permissions. 

• Avoid using applications that request refresh tokens, as these extend access periods and increase the risk of unauthorised access. 

• Request more specific OAuth scopes that limit access to only the files needed for the application’s functionality. 

• Store OAuth tokens securely, avoiding plain text storage in session storage or localStorage. Use encrypted storage methods where possible. Ensure that consent dialogs clearly communicate the extent of access being granted to users, helping them make informed decisions. 

Threat Landscape

This vulnerability has exposed millions of users to unauthorised data access, enabling third-party web applications to gain complete access to users’ entire OneDrive storage rather than just selected files. 

Microsoft has acknowledged the issue and indicated that improvements may be considered in the future. However, no specific timeline has been provided. 

This vulnerability underscores the need for robust monitoring and advanced security measures to detect and mitigate unauthorised access and data breaches effectively. 

Further Information

Microsoft OneDrive File Picker Vulnerability Exposes Users’ Entire Cloud Storage to Websites