Microsoft admits that there are loopholes in its Azure cloud service, and hackers can use other people's accounts to log in to third-party websites.

CTOnews.com, June 22 / PRNewswire-Asianet /-- Microsoft has admitted that there is an OAuth vulnerability in its Azure cloud service, which can be exploited by hackers to log in to third-party websites using someone else's Azure account.

The ▲ attack process demonstrates that Descope researchers from the graphic source Descope security software company named the vulnerability "nOAuth" and exists in the Active Directory of the Azure cloud service. Hackers only need to create an Azure account with an administrator, change the e-mail address of the account to someone else's e-mail address, and use "log in with Microsoft" to log in to a third-party website using someone else's Azure account.

▲ attack process demonstration, image source Descope

▲ attack process demonstration, image source Descope

In a demonstration of the ▲ attack, Imer Cohen, chief security officer of Tu Yuan DescopeDescope, said that Microsoft had a flaw in designing "authentication", which led to Azure's "nOAuth" vulnerability, which could affect a significant number of Azure users.

CTOnews.com noted that Microsoft has now acknowledged the vulnerability and issued a warning to users not to disclose their email messages and told third-party developers that Token should not be built into the client.