Microsoft fixed a major security flaw in its Authenticator app for Android that could compromise Work or School accounts on the device.
“An attacker who successfully exploited this vulnerability could potentially gain the ability to authenticate against a remote host using the current user’s credentials,” Microsoft Security explains. “An attacker could exploit this vulnerability by installing and running a malicious application on an affected Android device and convincing the user to complete an authentication flow in Microsoft Authenticator. Successful exploitation could allow the attacker to obtain authentication tokens and access resources as the affected user.”
The flaw was discovered by Enclave, which notes that “an unprivileged Android app with zero permissions could impersonate any installed Microsoft first-party app and have the Microsoft Authenticator broker hand it that app’s tokens.” It doesn’t require the user to do anything and the malicious app doesn’t need any special permissions or privileges. In testing the flaw, Enclave said that a test app it created was able to gain full access to the user’s work email, calendar, Teams messages, and files.
Microsoft thanked Enclave for responsibly reporting the flaw to it and letting it patch the bug before disclosing the vulnerability. If you do use Microsoft Authenticator, the app version published on September 8 includes the fix.