Microsoft Teams patched against image-based account takeover

[tarekma7]

After looking at how Microsoft Teams handles image resources, security researchers found a way to take over accounts by sending recipients a regular GIF.

The method could have been used for the desktop and web versions of Teams to get access to multiple accounts at once and steal conversations and threads.

Controlling a subdomain under teams.microsoft.com was the main condition for the attack, and the researchers had two to choose from. Microsoft received a report about the vulnerability and pushed mitigations to prevent the attack.

Continue reading HERE