Abusing Entra OAuth for fun and access to internal Microsoft applications

Re:Abusing Entra OAuth for fun and access to internal Micros... by nicce on Sunday August 10, 2025 @03:04PM (#44857411)

> In principle the idea of "zero trust" was to write your internal-facing webapps to the same high standards as your externally-facing code. You don't need the VPN, because you've fixed the many XSS bugs.

But why stop there? If these apps are not required to be accessed from public world, by setting up VPN you need to exploit both VPN and and the service to have an impact. Denial of specific service is harder and exploiting known CVEs is harder.

[ Parent | on HN ]

Re:Abusing Entra OAuth for fun and access to internal Micros... by Thiez on Monday August 11, 2025 @02:21AM (#44861227)

Because the protection that the VPN provides decreases the risk of having bugs to the point where they won't get prioritized, ever.

[ Parent | on HN ]

Re:Abusing Entra OAuth for fun and access to internal Micros... by nicce on Monday August 11, 2025 @08:42AM (#44863518)

That is just bad management, to be fair. Companies need to intentionally increase risks before they can fix them?

[ Parent | on HN ]

Re:Abusing Entra OAuth for fun and access to internal Micros... by pixl97 on Monday August 11, 2025 @10:17AM (#44864355)

Eh, at the same time VPNs can be a huge mess of problems on top of all the other problems that exist. Async routing is always a fun one in complex topologies.

[ Parent | on HN ]