Microsoft Dynamics 365 and Power Apps Web API Security Flaws Patched – Here’s A Quick Look at What to Know.

Recently, Microsoft patched three severe security vulnerabilities in its Dynamics 365 and Power Apps platforms. These flaws, discovered by Stratus Security, could have led to significant data breaches, exposing sensitive information such as contact details, financial data, and password hashes.

Details of the Vulnerabilities

OData Web API Filter Vulnerability: Access Control

• Lacked robust access control
• Allowed unauthorized access to the contacts table
• Attackers could exploit this using a “boolean-based search” technique
• Method involved iteratively querying the system with partial hash values

OData Web API Filter Vulnerability: “Orderby” Clause Misuse

• Involved the misuse of the “orderby” clause
• Allowed attackers to manipulate the order of data retrieval
• Could potentially expose critical information like email addresses

FetchXML API Vulnerability: Bypass Access Controls

• Allowed attackers to bypass existing access controls
• Retrieved restricted data columns by crafting malicious “orderby” queries
• Did not require a specific order (ascending or descending)

Potential Consequences

The successful exploitation of these vulnerabilities could lead to significant data breaches. Attackers could amass sensitive data, including password hashes and email addresses. This data could then be used for malicious activities such as cracking passwords, launching targeted attacks, or selling on the dark web.

Mitigation Strategies

Microsoft implemented patches in May 2024. Organizations must take proactive measures to enhance their security posture. This includes implementing strong authentication and authorization measures, such as robust password policies, multi-factor authentication, and regular security audits. Additionally, regular security reviews and penetration testing are crucial to identify and address potential vulnerabilities before they can be exploited by malicious actors.

Conclusion

This incident serves as a stark reminder of the ever-evolving threat landscape and the critical need for continuous vigilance in maintaining a secure digital environment. By addressing these vulnerabilities and implementing robust security measures, organizations can better protect their sensitive data and mitigate the risk of future attacks.

You think you have a story worth everyone’s time? SUBMIT A STORY and we will publish it