Ethical Hacking News
Microsoft Entra ID has been left vulnerable to exploitation by a critical combination of legacy components, allowing for the hijacking of any company's tenant.
The Azure AD Graph API vulnerability (CVE-2025-55241) allows for the hijacking of any company's tenant, granting unauthorized access to highly sensitive data. A token validation issue was discovered by security researcher Dirk-jan Mollema, giving him Global Admin privileges in every Entra ID tenant. Actor tokens, used for authentication with SharePoint applications and internally by Microsoft, can be used to impersonate any user in the tenant when talking to Exchange Online, SharePoint, and the Azure AD Graph. The researcher found that actor tokens have no logs, are unrevokable for 24 hours, and bypass restrictions configured in Conditional Access. Micrsoft patched CVE-2025-55241 nine days after being reported and confirmed the problem was resolved.
Microsoft Entra ID, a cloud-based identity and access management (IAM) service, has been left vulnerable to exploitation by a critical combination of legacy components. The Azure AD Graph API vulnerability, denoted as CVE-2025-55241, allows for the hijacking of any company's tenant, granting unauthorized access to highly sensitive data.
The flaw was discovered by security researcher Dirk-jan Mollema, founder of Outsider Security, who identified a token validation issue that gave him Global Admin privileges in every Entra ID tenant. This level of access enables full tenant compromise and opens the door to any service authenticated through Entra ID. Impersonating any user in the tenant is also possible using actor tokens.
Actor tokens are issued by a legacy service called Access Control Service, used for authentication with SharePoint applications and internally by Microsoft. Mollema found them while investigating hybrid Exchange setups. He noted that the Actor token allows the "actor" to 'act' as another user in the tenant when talking to Exchange Online, SharePoint, and the Azure AD Graph.
The researcher's investigation revealed several concerning aspects of actor tokens:
1. **No logs**: There are no logs when actor tokens are issued or used.
2. **Unrevokable**: Actor tokens have a 24-hour validity without the possibility of being revoked during this period.
3. **Bypassing restrictions**: These tokens completely bypass any restrictions configured in Conditional Access.
Mollema reported his findings to Microsoft on July 14 and claimed that the company confirmed the problem was resolved nine days later. On September 4, Microsoft also patched CVE-2025-55241, describing it as a critical privilege escalation vulnerability in Azure Entra.
To understand the implications of this vulnerability, let us examine how an attacker might exploit it:
1. **Finding the tenant ID**: An attacker can find the tenant ID for the targeted environment using public APIs based on the domain name.
2. **Finding a valid netId**: The attacker must then find a valid netId of a regular user in the target tenant, which is possible without much difficulty given that Microsoft 365 services offer this information to users.
3. **Crafting an impersonation token**: With the tenant ID and netId of the user in the victim tenant, the attacker crafts an impersonation token using the actor token from the attacker's tenant.
4. **Listing Global Admins**: The attacker lists all Global Admins in the tenant and their netId to further personalize their attack.
5. **Crafting a final token**: Using this information, the attacker crafts a final impersonation token for the Global Admin.
6. **Performing actions**: They then use the Azure AD Graph API to perform any read/write action without leaving a trace in the logs of the targeted environment, except for their own actions.
It is crucial to note that Microsoft started deprecation processes for the Azure AD Graph API service in September last year and warned apps configured for extended access but still using Azure AD Graph would no longer be able to use the APIs starting early September 2025.
The vulnerability highlights the importance of monitoring system updates, reviewing internal security measures, and ensuring all software is up-to-date. Companies must prioritize cybersecurity to protect sensitive data and maintain the trustworthiness of their systems.
Related Information:
https://www.ethicalhackingnews.com/articles/Microsoft-Entra-ID-Vulnerability-Exposed-A-Global-Identity-Crisis-ehn.shtml
https://www.bleepingcomputer.com/news/security/microsoft-entra-id-flaw-allowed-hijacking-any-companys-tenant/
https://redteamnews.com/red-team/cve/critical-microsoft-entra-id-flaw-enabled-global-tenant-hijack/
https://nvd.nist.gov/vuln/detail/CVE-2025-55241
https://www.cvedetails.com/cve/CVE-2025-55241/
Published: Sun Sep 21 13:25:33 2025 by llama3.2 3B Q4_K_M
