{"id":5450,"date":"2025-07-18T10:00:29","date_gmt":"2025-07-18T10:00:29","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/07\/18\/microsoft-entra-id-vulnerability-let-attackers-escalate-privileges-to-global-admin-role\/"},"modified":"2025-07-18T10:00:29","modified_gmt":"2025-07-18T10:00:29","slug":"microsoft-entra-id-vulnerability-let-attackers-escalate-privileges-to-global-admin-role","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/07\/18\/microsoft-entra-id-vulnerability-let-attackers-escalate-privileges-to-global-admin-role\/","title":{"rendered":"Microsoft Entra ID Vulnerability Let Attackers Escalate Privileges to Global Admin Role"},"content":{"rendered":"

Microsoft Entra ID Vulnerability Let Attackers Escalate Privileges to Global Admin Role
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A critical vulnerability in Microsoft Entra ID allows attackers to escalate privileges to the Global Administrator role through the exploitation of first-party applications.\u00a0<\/p>\n

The vulnerability, reported to Microsoft Security Response Center (MSRC) in January 2025, affects organizations using hybrid Active Directory environments with federated domains.<\/p>\n

Key Takeaways<\/strong>
<\/mark>1. Attackers with certain admin or app permissions can hijack the Office 365 Exchange Online service principal.
2. Attackers use the Domain.ReadWrite.All to add a malicious federated domain and forge SAML tokens.
3. Microsoft classified this risk as \"expected behavior\".<\/pre>\n
Microsoft Entra ID Vulnerability<\/strong><\/h2>\n
Security researchers at Datadog discovered<\/a> that service principals (SPs) assigned the Cloud Application Administrator role, Application Administrator role, or Application.ReadWrite.All permission can escalate their privileges by hijacking the built-in Office 365 Exchange Online service principal (Client ID: 00000002-0000-0ff1-ce00-000000000000).<\/p>\n
The vulnerability works by exploiting the Office 365 Exchange Online SP\u2019s Domain.ReadWrite.All permission to add a new federated domain to the tenant.\u00a0<\/p>\n
Attackers can then forge SAML tokens as any hybrid tenant user synchronized between on-premises Active Directory<\/a> (AD) and Entra ID, including users with Global Administrator privileges.<\/p>\n
\"\"
Backdooring SPs<\/figcaption><\/figure>\n
The attack leverages the client credentials grant flow for authentication:<\/p>\n
\n
\"\"<\/figure>\n<\/div>\n
Federated Domain Backdoor Technique<\/strong><\/h2>\n
The privilege escalation follows a five-step process involving federated domain manipulation.\u00a0<\/p>\n
Attackers first add a malicious domain using the Microsoft Graph API<\/a> endpoint POST \/v1.0\/domains, then verify it through DNS records.\u00a0<\/p>\n
The critical step involves configuring federation settings via POST \/v1.0\/domains\/{domain}\/federationConfiguration with a malicious certificate:<\/p>\n
\n
\"\"<\/figure>\n<\/div>\n
\"\"
Malicious domain appears as federated in Entra ID<\/figcaption><\/figure>\n
This configuration allows attackers to forge SAML tokens<\/a> with MFA claims, bypassing multi-factor authentication requirements while maintaining the appearance of legitimate authentication in sign-in logs.<\/p>\n
\n
\"\"
Sign-in prompt as a Global Administrator with forged SAML token<\/figcaption><\/figure>\n<\/div>\n
Microsoft\u2019s Response\u00a0<\/strong><\/h2>\n
Datadog reported this vulnerability to the Microsoft Security Response Center (MSRC) on January 14, 2025, initiating a months-long disclosure process.\u00a0<\/p>\n
However, on May 14, 2025, MSRC concluded that this \u201cis not a security vulnerability but expected behavior of the Application Administrator role and its associated permissions\u201d.<\/p>\n
Microsoft\u2019s response emphasized that the scenario reflects misconfiguration rather than a security bypass, stating that Application Administrator roles inherently include the ability to manage application credentials and impersonate application identities.<\/p>\n
Boost detection, reduce alert fatigue, accelerate response; all with an interactive sandbox built for security teams ->\u00a0Try ANY.RUN Now<\/a>\u00a0<\/strong><\/p>\n
The post Microsoft Entra ID Vulnerability Let Attackers Escalate Privileges to Global Admin Role<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n
 \t

\n 
<\/BR>
\n    Guru Baran
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n 
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"
Microsoft Entra ID Vulnerability Let Attackers Escalate Privileges to Global Admin Role A critical vulnerability in Microsoft Entra ID allows attackers to escalate privileges to the Global Administrator role through the exploitation of first-party applications.\u00a0 The vulnerability, reported to Microsoft Security Response Center (MSRC) in January 2025, affects organizations using hybrid Active Directory environments with […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,131,648],"tags":[130],"class_list":["post-5450","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-vulnerability","category-vulnerability-news","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/5450"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=5450"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/5450\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=5450"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=5450"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=5450"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}