There may be some significant security vulnerabilities with Microsoft Teams

Share This Post

While investigating this issue, researchers discovered that the Teams SOP could be circumvented by abusing the link preview feature of Microsoft’s video conferencing software. This allows the client to generate link previews for landing pages, generate summary text or visuals, and extract information using character recognition (OCR) on preview images. But in doing so, Fabian Bräunlein, co-founder of Positive Security, discovered another separate vulnerability in the feature’s implementation.

Security researchers have identified four separate vulnerabilities in Microsoft Teams that attackers could exploit to forge link previews, leak IP addresses, and access internal services of the software giant. I found
These findings were made by Positive Security researchers while looking for ways to bypass the Same Origin Policy (SOP) in Teams and Electron, according to a new blog post. For those unfamiliar, SOP is a browser security mechanism that helps prevent websites from attacking each other.


  • DOS bugs are of particular concern. An attacker could crash the Teams app for Android by sending a user a message containing a preview link with an invalid preview link target. Unfortunately the app keeps crashing when I try to open a chat or channel with a malicious message. Microsoft responsibly disclosed its findings on March 10th through its bug bounty program. In the meantime, however, the software giant has only patched his IP address leak vulnerability in Teams for Android. Now that Positive Security has published its findings, Microsoft may need to patch his three remaining vulnerabilities, but they don’t pose an immediate threat to users, the researchers told researchers.

  • Microsoft Teams vulnerabilities. Of the four bugs Bräunlein discovered in Teams, two can be used on any device and allow server-side request forgery (SSRF) and spoofing, while the other two only affect Android phones. , can be exploited to leak IP addresses or achieve denial of service (DOS). By exploiting the SSRF vulnerability, the researcher was able to leak information from his Microsoft local network. Spoofing bugs, on the other hand, can be used to make phishing attacks more effective or hide malicious links.

Related Posts

As Stadia greets, Luna welcomes new games for October

While Luna is still around and Amazon recently unveiled...

Sega presented Sangokushi Taisen, a blockchain game

Over the past few months, several major Japanese publishers,...

Management change announced by NaaS Technology Inc

Alex Wu served as Interim Chief Financial Officer of...

health and communications leaders join the Oregon board Tech Foundation

Two new members have just joined the Oregon Tech...