Skip to main content

Flaw In Microsoft OneDrive Grants Access To External Apps

Researchers at Oasis Security revealed last week that a flaw in Microsoft’s OneDrive File Picker was allowing external apps, such as Zoom, ChatGPT, Trello, Slack, and ClickUp, access to users’ content. The experts warn that millions of users could be affected, with potential risks of data leakage and compliance regulations violations.

According to the report, published on May 28 and titled ChatGPT & other web apps may have full read access to your entire OneDrive, external apps were able to access users’ entire document collections during uploads, rather than being limited to specific files.

“This issue arises from the lack of fine-grained OAuth scope for OneDrive, which causes the official OneDrive File Picker implementation to request read access to the entire drive — even when uploading just a single file,” states the document.

The cybersecurity firm reached out to Microsoft and relevant app vendors before publicly disclosing the vulnerability. Microsoft responded it would consider the research for future improvements.

The research team also explained that when users granted broad OAuth access, the linked applications could also modify the cloud storage and remain connected for extended periods of time.

OneDrive File Picker’s permissions included support for third-party file uploads and downloads, allowing external websites to read and write the entire OneDrive account, considered by Oasis as “a case of excessive permissions.”

“This isn’t just a privacy concern, it’s a potential security gap affecting millions of users and potentially exposing sensitive personal and professional information,” wrote the cybersecurity company on its website. “This happens because of how Microsoft’s OneDrive File Picker works: it requests broad permissions that stay active for up to an hour, or longer if refresh tokens are used.”

Oasis recommends that users review which apps have access to their OneDrive accounts and revoke all suspicious permissions. The research team also encouraged spreading awareness and being cautious when uploading content to unfamiliar websites.

A few days ago, malicious actors exploited a vulnerability in Google’s OAuth system, successfully sending phishing emails that appeared authentic through a DKIM replay attack.



See TessMore Internet Business Must-Reads
Labels:

Comments

Post a Comment

Popular posts from this blog

Thousands Still Available in COVID Relief with These Small Business Grants

Building improvements can be a major expense for small businesses. And many had to make certain changes to navigate the past few years. Restaurants set up outdoor patios. Historic properties restored their storefronts. And offices added energy efficient features. Many businesses also have improvement projects planned for 2022. Luckily, many small business grant programs across the country make these projects more attainable, thus improving the customer experience and the community at large. Here are some current small business grant opportunities for building improvements, pandemic recovery, and more. Raleigh Building-Up Fit Grant Raleigh’s Small Business Development department is launching a new grant opportunity for local businesses. The Building-Up Fit Grant offers matching reimbursement funds up to $25,000 for eligible renovation projects. Businesses with 50 employees or less can apply for grants to cover projects that significantly improve the appearance and value of the pro...
Post a Comment
Read more

Top 50 Cryptocurrencies

Cryptocurrencies are digital currencies that act as mediums for exchange, just like regular money. One of the differences between cryptocurrencies and paper money is that cryptocurrencies are designed to exchange information digitally through public databases or blockchains. The blockchain is database is distributed across computers that run using blockchain software. No single entity owns or controls the database, and anyone can access the database, offer proof of ownership, and transfer cryptocurrencies through the use of crypto wallets. the global cryptocurrency market in just a decade has grown exponentially. How Many Cryptocurrencies are There? The crypto space is vast there are over 10,000 digital currencies in the market today. Due to the relative ease to launch different cryptocurrencies developers and businesses are tapping into the global crypto market to generate profits and connect with tech – savvy communities. Users too are opening cryptocurrency investment accounts in...
Post a Comment
Read more

14 Referral Software Tools that Boost Sales

As a business owner, you want to keep your customers happy. That’s because happy customers are also advocates for your business. One way you can leverage existing customers to grow your business is by choosing the best referral marketing tools. What is Referral Marketing Software? For all their benefits, referral programs involve several moving parts. You need to track every referral, figure out which customers got you the most number of leads and analyze the value of each referral. This is where a referral tracking software can make things easier for you. Some of the best affiliate programs for small business automatically track every referral to the customer, issue instant rewards and provide data to help refine your referral program. Why You Should Consider Referral Program Software for Your Business The biggest advantage of using a software for the entire referral process is to make it seamless and less time consuming. Let’s take a closer look at all the benefits of using a...
Post a Comment
Read more