nOAuth Lives On in Cloud App Logins Using Entra ID

A flaw in a Microsoft single sign-on feature allowing cloud app account takeovers discovered in 2023 never really went away, say researchers – notwithstanding a computing giant claim that it almost immediately fixed the vulnerability known as nOAuth.

See Also: Proof of Concept: Rethinking Identity for the Age of AI Agents

The flaw allows hackers to log into apps that accept Microsoft Entra ID for single sign-on. In the attack, hackers set up an Entra ID account and later reconfigured the identifier as the email address of a victim. The attack isn’t sophisticated, involving a few minutes’ worth of modifying an attacker-controlled Entra ID account. It takes advantage of software-as-a-service apps that accept unverified emails as an Entra ID identifier.

It turns out a lot of SaaS services do so. “We found an HR platform that was vulnerable. I could probably go find customers of that platform and who their major admins are and get access to all that [personally identifiable information],” said Eric Woodruff, chief identity architect at active directory security specialists Semperis. Woodruff presented Wednesday research about nOAuth’s long tail at the Troopers Cybersecurity Conference in Germany.

Semperis tested roughly 100 applications that permit self-sign up and are listed by Microsoft as accepting Entra IDs. It found about 9% to be vulnerable to nOAuth. The company’s testing sample of 104 apps “is only a drop in the bucket of SaaS applications out there that are integrated with Entra ID. You can extrapolate these numbers against the tens of thousands of available SaaS applications,” Woodruff wrote in a blog post. Information Security Media Group contacted Microsoft but did not hear back. Semperis said it began engaging with Microsoft in December over its findings but the company stopped contact in April with no explanation.

When authentication management firm Descope published its findings on nOAuth in June 2023, Microsoft responded with a blog post reiterating that app developers shouldn’t rely on email addresses for authorization purposes. It also “deployed mitigations to omit token claims from unverified domain owners for most applications.”

Microsoft said it notified app owners who configured Entra ID single sign-on to accept unverified email addresses. “I can’t objectively say, yes to ‘Microsoft didn’t notify everyone,’ but the findings seem contradictory to what they wrote about in 2023,” Woodruff told ISMG.

The mitigation Microsoft announced amounted to changing Entra ID app registration settings to reject by default unverified email addresses, Woodruff added.

“Of course, thousands upon thousands of SaaS applications have been in existence since before June 2023, and many developers still want and need to consume the email address; many SaaS applications want to send email to end users, and consumption through a claim is the easiest way to get that information,” he wrote in a blog post.

Developers can also still configure apps to accept unverified emails when they register into Entra ID.

Woodruff also said he’s concerned that Microsoft might have deprecated an optional feature allowing developers to determine whether an email linked to a specific Entra ID is verified or not. The feature is not available in the user interface for setting up token configuration, he said.

App customers have little recourse to defend against nOAuth if the settings accept unverified emails as an Entra IDs, Woodruff said. Traditional advice – such as setting up multifactor authentication or conditional access – don’t work in this case.

“You can’t really do anything about it,” Woodruff said, “besides hope that the developer fixes their application. Honestly, you won’t even likely know that the app is vulnerable. Theoretically, if you did, your only defense would be basically to stop using the application.”