Researchers have discovered a technique to manipulate the credential validation course of in Microsoft Entra ID identification environments that they are saying attackers can use to bypass authentication in hybrid identification infrastructures.
The assault would require an adversary to have admin entry on a server internet hosting a Go-By Authentication (PTA) agent, a part that permits customers to register to cloud companies utilizing on-premises Microsoft Entra ID (previously Azure Energetic Listing) credentials.
They’ll then use that entry to log in as an Entra ID consumer throughout totally different on-premises domains with out the necessity for separate authentication, researchers from Cymulate mentioned in a report.
Turning PTA Right into a Double-Agent
“This vulnerability successfully turns the PTA agent right into a double agent, permitting attackers to log in as any synced AD consumer with out realizing their precise password,” Cymulate safety researcher Ilan Kalendarov wrote.
“This might doubtlessly grant entry to a worldwide admin consumer if such privileges had been assigned, no matter their authentic synced AD area,” and allow lateral motion to totally different on-premises domains.
Microsoft didn’t reply instantly to a Darkish Studying request for remark. However in line with Cymulate, Microsoft plans to repair code on its finish to deal with the problem. Nonetheless, the corporate additionally has described the assault method as presenting solely a medium-severity risk, the Israel-based safety vendor mentioned.
Earlier this month at Black Hat USA 2024, a safety researcher at Semperis disclosed one other challenge with Entra ID that allowed attackers to entry to a company’s complete cloud setting.
Attackers are more and more specializing in cloud identification companies resembling Entra ID, Okta, and Ping, as a result of as soon as they’re able to compromise one among these suppliers, they’ve full entry to enterprise knowledge in SaaS apps.
Learn the remainder of this text in Darkish Studying.
