Outline、Azure SSOで他人になりすまし可能 修正版1.11.0
Summary
Wikiツール Outline の Microsoft Azure SSO に、他社の Microsoft Entra テナントを持つ攻撃者が既存ユーザーになりすましてログインできる弱点が見つかりました。Azure SSO を使い、AZURE_TENANT_ID を設定していない Outline が対象で、修正版は 1.11.0 です。該当する場合は版の更新を行い、更新できない間は AZURE_TENANT_ID の設定を確認してください。
AI summary
Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.
Wikiツール Outline の Microsoft Azure SSO に、他社の Microsoft Entra テナントを持つ攻撃者が既存ユーザーになりすましてログインできる弱点が見つかりました。Azure SSO を使い、AZURE_TENANT_ID を設定していない Outline が対象で、修正版は 1.11.0 です。該当する場合は版の更新を行い、更新できない間は AZURE_TENANT_ID の設定を確認してください。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| other | Outline |
< 1.11.0 |
1.11.0 |
Original description The description as published by the source.
Summary
When Outline is configured with Microsoft Azure SSO and AZURE_TENANT_ID is unset (the default multi-tenant mode), an attacker who controls any free Microsoft Entra tenant can sign in as any existing user of any Azure-SSO-enabled workspace. The attacker sets the mail attribute on their own Entra user to the victim's email address — Microsoft performs no domain-ownership check on this attribute — and initiates a sign-in. Outline treats the mail value from the Microsoft Graph API as proof that the email is verified, bypassing the intended xms_edov/email_verified verification claims. The attacker receives a session as the victim with full read/write access to every document, collection, and setting the victim can reach. No interaction from the victim is required.
Details
The vulnerability is in plugins/azure/server/auth/azure.ts in the Azure SSO callback handler. The file is analyzed against commit 621b00ffc7e7bd09bf56292bfceeba093c6c760b.
1. Multi-tenant endpoint accepts any Entra tenant
At line 81, when AZURE_TENANT_ID is unset the strategy uses Microsoft's multi-tenant common endpoint, allowing authentication from any Microsoft tenant:
// plugins/azure/server/auth/azure.ts:81
useCommonEndpoint: env.AZURE_TENANT_ID ? false : true,
AZURE_TENANT_ID is optional and unset by default (plugins/azure/server/env.ts:27).
2. Email resolved from attacker-controlled sources
At lines 136–139, the user's email is resolved with a…
Source: GitHub Repository Security Advisories (Game のスタック) GitHub Advisory OSV
References
- GITHUB_REPO_ADVISORY outline/outline