Microsoft Password Reset Portal Exposes User Data, Aiding Attackers
A vulnerability in Microsoft Entra ID's Self-Service Password Reset portal allows unauthenticated users to discover account existence and MFA methods, aiding attackers in targeted attacks.
Microsoft's Entra ID platform, a cornerstone for identity and access management, features a Self-Service Password Reset (SSPR) portal designed to help users recover forgotten credentials. However, recent research has uncovered a significant flaw within this portal: it can inadvertently reveal sensitive information about user accounts to unauthenticated individuals. This exposure includes whether an account exists within the organization and details about the Multi-Factor Authentication (MFA) methods registered for that account. Such information is invaluable to malicious actors seeking to refine their attack strategies, particularly for phishing, password-spraying, and social engineering campaigns.
The vulnerability stems from variations in the server's responses based on the input provided. When a user attempts to reset their password via the public portal, the system's reply can indicate the validity of the account, its eligibility for SSPR, and the specific verification methods available. For instance, if an account does not exist, the portal might remain on the initial identifier screen. Conversely, a valid account might proceed to the method selection stage or generate a policy-related error. These subtle differences in response, particularly policy-related messages, can confirm that an account is recognized by the system, even if SSPR is not enabled for it. This allows attackers to perform user enumeration, building lists of valid corporate accounts from publicly available data or previous breaches before launching more targeted attacks.
Further complicating matters, for users who are eligible for SSPR, the portal can disclose the types of verification methods they have registered. This might include options like Microsoft Authenticator app codes, SMS messages, voice calls, or security questions. The nature of these verification methods directly impacts their resistance to attack. Accounts secured with an authenticator app or other robust sign-in methods are considerably harder to compromise than those relying on less secure options like email one-time passwords (OTPs) or SMS. Armed with this knowledge, attackers can tailor their social engineering tactics. For example, identifying a target that uses SMS for verification could prompt an attacker to attempt a SIM-swapping attack or a live phishing session, leveraging the known verification method.
The research also suggests that privileged accounts might be more easily identifiable depending on the specific tenant configurations. Administrator roles often have different password reset requirements compared to standard users, and some organizations may exclude regular users from SSPR altogether. If an account successfully progresses through the portal to the method selection phase, and SSPR is restricted for general users, it could potentially indicate a privileged account. This makes such accounts prime targets for attackers, as compromising them can yield significant access and control within an organization's network.
While Microsoft has implemented some protective measures, such as rate limiting for password reset attempts, these are not sufficient to prevent the reconnaissance facilitated by this vulnerability. Organizations are urged to review their SSPR configurations carefully, ensuring that only appropriate users are included in SSPR policies. The adoption of strong, phishing-resistant MFA methods is highly recommended, especially for privileged accounts, and reliance on weaker methods like security questions should be minimized.
Security teams should also actively monitor Microsoft Entra ID audit and sign-in logs for suspicious patterns. This includes observing numerous failed password reset attempts across multiple usernames, unusual requests targeting executive accounts, and frequent account validation failures. Proactive monitoring can help detect early signs of reconnaissance or attempted attacks leveraging this information disclosure.
Proof-of-concept tools, such as the publicly available ResetSpy, demonstrate how these response discrepancies can be automated to efficiently enumerate users and assess SSPR vulnerabilities. This highlights the immediate need for organizations to implement the recommended security practices and for Microsoft to address the underlying issue within the SSPR portal to prevent its exploitation for malicious purposes.