A security vulnerability in Microsoft OneDrive’s file picker has left the cloud storage users exposed to third-party apps. The file picker requests OAuth permissions, which in turn grant external apps access to the user’s entire drive rather than the specific files selected for download or upload.
The bug was discovered by cybersecurity firm Oasis Security, who describe it in their report as a “classic case of over-permissioned OAuth scopes combined with a misleading consent flow.” The report goes on to add that hundreds of popular web apps like ChatGPT, Slack, Trello, and more integrate with OneDrive to facilitate file uploads, except the integrations give them access to the user’s entire cloud storage.
Different versions of the file picker also have different flaws. Version 7.0 of the file picture requires both read and write access even during uploads. Older versions also handle OAuth tokens via URL fragments and local storage — not the best way to deal with sensitive data. Version 8.0 slightly improves the situation by offloading authentication, but the access scopes are still quite broad.
To make matters worse, consent dialogs on OneDrive apparently do not properly communicate the extent of access the user may be providing to an app. In theory, a malicious app can exploit the bug to gain access and expose sensitive files a user or organisation may have stored on the drive.
Since there’s no active fix from Microsoft, current mitigations include checking whether or not a web app has access and temporarily revoking it unless you trust the developer. The best option is to remove the option to upload files using OneDrive through OAuth until Microsoft patches the issue. Users should also avoid using refresh tokens and store their access tokens securely.
Google and Dropbox have more restrictive models that have a safer approach to file security. If you have to use OneDrive, you can also try using view-only links from the cloud storage, although this will impact your workflows and will be less convenient for users.
In the News: Hackers are using SEO poisoning to commit payroll fraud
