Ethical Hacking News
A recent vulnerability discovered in Microsoft's Entra ID service has left millions of users and organizations at risk of global admin impersonation. The newly discovered flaw carries the maximum CVSS score of 10.0 and has been described by Microsoft as a "privilege escalation flaw" in the Azure Entra service.
Microsoft has issued a critical patch for a severe vulnerability in its Entra ID service (Azure Active Directory), which can be exploited by attackers to impersonate any user, including Global Administrators. The vulnerability stems from a combination of two components: S2S actor tokens and the legacy Azure AD Graph API, allowing attackers to bypass multi-factor authentication and logging mechanisms. The lack of API-level logging made it easy for attackers to exploit this vulnerability, potentially leading to a full tenant compromise. Microsoft has addressed this vulnerability by releasing the patch on July 17, 2025, requiring no customer action. The incident highlights the importance of cloud security and the need for organizations to stay vigilant in protecting their sensitive data and infrastructure.
Microsoft has recently issued a critical patch for a severe vulnerability in its Entra ID service (previously known as Azure Active Directory), which has left millions of users and organizations at risk of global admin impersonation. The newly discovered flaw, tracked as CVE-2025-55241, carries the maximum CVSS score of 10.0 and has been described by Microsoft as a "privilege escalation flaw" in the Azure Entra service.
According to security researcher Dirk-jan Mollema, who first reported the shortcoming on July 14, 2025, this vulnerability made it possible for attackers to impersonate any user, including Global Administrators, across any tenant. This is particularly alarming because Global Admins have broad access to customer content and can grant themselves rights on Azure subscriptions.
The vulnerability stems from a combination of two components: the use of service-to-service (S2S) actor tokens issued by the Access Control Service (ACS) and a fatal flaw in the legacy Azure AD Graph API that did not adequately validate the originating tenant. This allowed attackers to use these tokens for cross-tenant access, effectively bypassing multi-factor authentication and logging mechanisms.
The lack of API-level logging for the Graph API made it even easier for attackers to exploit this vulnerability, allowing them to access user information stored in Entra ID, group and role details, tenant settings, application permissions, and device information synced to Entra ID without leaving any traces. This could have resulted in a full tenant compromise with access to any service that uses Entra ID for authentication, such as SharePoint Online and Exchange Online.
Fortunately, Microsoft has addressed this vulnerability by releasing the patch on July 17, 2025, requiring no customer action. However, the incident highlights the importance of cloud security and the need for organizations to stay vigilant in protecting their sensitive data and infrastructure.
According to researchers from RiskInsight, techniques such as AccessKey injection, trust policy backdooring, and the use of NotAction policies allow attackers to persist without deploying malware or triggering alarms. Moreover, disabling CloudTrail, modifying event selectors, deploying lifecycle policies for silent S3 deletion, or detaching accounts from AWS Organizations can all reduce oversight and enable long-term compromise or destruction.
The incident serves as a reminder that even seemingly innocuous misconfigurations in cloud environments can have disastrous consequences. As the threat landscape continues to evolve, it is essential for organizations to invest in robust security measures and stay informed about emerging vulnerabilities and threats.
In related news, Microsoft has also characterized this type of cross-tenant access as a case of "High-privileged access" (HPA) that occurs when an application or service obtains broad access to customer content, allowing it to impersonate other users without providing any proof of user context. This highlights the importance of robust security measures and monitoring in preventing such attacks.
In conclusion, the recent patch by Microsoft for the critical Entra ID flaw underscores the importance of cloud security and the need for organizations to stay vigilant in protecting their sensitive data and infrastructure. As the threat landscape continues to evolve, it is essential for organizations to invest in robust security measures and stay informed about emerging vulnerabilities and threats.
Related Information:
https://www.ethicalhackingnews.com/articles/MICROSOFT-Patches-Critical-Entra-ID-Flaw-Leaving-Millions-Vulnerable-to-Global-Admin-Impersonation-ehn.shtml
https://thehackernews.com/2025/09/microsoft-patches-critical-entra-id.html
Published: Mon Sep 22 01:29:48 2025 by llama3.2 3B Q4_K_M
