CQURE Hacks #82: Microsoft Entra ID Conditional Access Bypass via User-Agent Policy Gap

Source: CQURE Academy

Author: Asia

URL: https://cqureacademy.com/blog/cqure-hacks-82-microsoft-entra-id-conditional-access-bypass-via-user-agent-policy-gap/

ONE SENTENCE SUMMARY:

A User-Agent–based Conditional Access gap enabled Xbox token issuance without MFA, leading to Graph access, secret discovery, and full tenant compromise.

MAIN POINTS:

1. Conditional Access trusted device platforms based solely on client-controlled User-Agent strings.
2. Policies blocked Windows, Linux, and iPhone, but overlooked Xbox Series X.
3. Xbox User-Agent allowed Microsoft Graph token acquisition without triggering MFA.
4. Obtained access token enabled direct Graph API access despite portal restrictions.
5. GraphRunner enumerated users, groups, and roles through Microsoft Graph.
6. Portal blocking proved ineffective because underlying APIs remained accessible.
7. Custom scripting searched directory objects for exposed credentials and secrets.
8. A clear-text password was found stored in a group description attribute.
9. Exposed credentials belonged to a break-glass Global Administrator account.
10. Chaining policy gaps with poor secret storage resulted in full tenant compromise.

TAKEAWAYS:

1. Expand Conditional Access coverage to include Graph/API token acquisition flows.
2. Avoid security decisions based on manipulable client signals like User-Agent.
3. Enforce MFA consistently across all sensitive access paths, not just portals.
4. Prevent secrets from being stored in readable directory attributes and descriptions.
5. Assume attackers will chain minor misconfigurations into high-impact compromises.