Image: cdn.prod.website-files.com · rights & removal

Hunting Conditional Access Policy Bypass in the Wild: Leveraging Malicious Browser Extensions for Seamless Initial Access

Reporting by Mitiga ResearchRead the original at mitiga.io

Executive Summary

The article details an attack methodology that leverages a combination of phishing, malicious browser extensions, and OAuth 2.0 flows to bypass Microsoft Conditional Access Policies (CAPs) and gain access to the MS Graph API from unmanaged devices. A specific technique involves using a compromised session or obtained tokens to interact with the authentication endpoints, including obtaining an authorization code and redeeming it for an access token. The process highlights how a malicious browser extension can be used in conjunction with phishing to capture necessary credentials or tokens, facilitating a Browser-in-the-Middle (BiTM) attack against OAuth flows. The demonstration shows that successfully obtaining an access token allows for direct access to scoped resources like the Microsoft Graph API, demonstrating a failure point when Conditional Access policies are not fully enforced across all access vectors.

Facts Only

* A talk at Black Hat EU 2024 detailed an attack path involving a client ID: 9ba1a5c7-f17a-4de9-a1f1-6178c8d51223.
* An article by JUMPSEC labs demonstrated reproduction of this technique using the "TokenSmith" tool to automate the procedure.
* The attack required pre-requisites such as primary authentication/MFA tokens or valid session cookies (ESTSAUTH and ESTSAUTHPERSISTENT) and a Chromium-based browser.
* Authentication involved initiating an OAuth 2.0 authorization request to `https://login.microsoftonline.com/common/oauth2/v2.0/authorize` with specific parameters including `clientid`, `scope`, `responsetype=code`, and a specific `redirecturi`.
* The process involved obtaining an authorization code via observation of console errors during the redirection stall.
* An access token was redeemed from the OAuth 2.0 endpoint `/token` using the authorization code.
* A subsequent request was made to the Graph API host, targeting a user profile via a GET request, utilizing the obtained Bearer access token.
* The attack demonstrated access to Microsoft Graph from a non-compliant, unmanaged, and untrusted device.
* The technique involves using a malicious browser extension to obtain an access token, often combined with Adversary in the Middle (AiTM) techniques.
* Mitigation suggestions include auditing authentication from non-compliant devices, enforcing MFA, minimizing Graph API permissions, and monitoring activity logs for anomalies.
* A specific detection schema was proposed: `Logtype = InteractiveSignIns` AND `deviceDetails == (“IsManaged: False”, “IsCompliant: False”, “IsTrusted: False”)` AND `errorCode == 0` AND `clientId == ‘9ba1a5c7-f17a-4de9-a1f1-6178c8d51223’` AND (`resourceName == ‘Microsoft Graph’` OR `resourceName == ‘Microsoft AD Graph’`).
* An update noted that the vulnerability in Microsoft Graph was addressed by fully descoping resource permissions.

Full Take

The narrative centers on a tension between policy enforcement (CAPs) and the operational reality of token-based access, suggesting that perimeter controls alone are insufficient against sophisticated identity attacks. The core pattern exposed is the gap between theoretical security controls and practical implementation across diverse endpoints. An entity can enforce strict policies like CAPs, but if the initial credential collection or token exchange process has exploitable flaws—whether through phishing or browser extension manipulation enabling a BiTM posture—the policy circumvention becomes trivial. This forces an examination of where trust is actually established in modern identity systems: at the endpoint device and the execution environment of the authentication flow. The shift from relying on MFA as the primary control to recognizing that tokens themselves can be hijacked necessitates a deeper focus on runtime session management and resource authorization, rather than just initial login verification. The proposed detection schema exemplifies a necessary pivot from monitoring simple access attempts to correlating device posture with specific API interactions. What remains to be interrogated is whether the efficacy of behavioral detection and continuous auditing truly closes the gap between policy declaration and operational reality.
Patterns detected: ARC-0043 Motte-and-Bailey, ARC-0024 Ambiguity, ARC-0051 Pattern Recognition

From the original · Mitiga Research

Table of Contents Introduction Initial access remains a key concern for most organizations today. While Entra Conditional Access policies (CAPs) are often seen as a way to mitigate risks, they may be perceived as questioning employees' trustworthiness.

Read the full story at mitiga.io

Sentinel — Human

Confidence

This text reads like a detailed technical briefing or whitepaper presented by security researchers, focusing on an exploitation technique against Microsoft authentication flows, supported by specific, actionable technical evidence.