Exploitable SAS Tokens in Microsoft PC Manager Supply Chain

Understanding Microsoft PC Manager

• 🎯 Microsoft PC Manager is a tool designed for remote PC management, enabling system administration and control over multiple systems.
• 💡 It functions as a defensive and administrative tool, allowing users to manage storage and perform pop-up management tasks.

The Risk of Overly Permissive SAS Tokens

• 🔑 Shared Access Signature (SAS) tokens are intended to grant limited access to Azure storage resources.
• ⚠️ When configured too broadly, SAS tokens can be abused by attackers to alter software packages or inject malicious code, creating a supply chain threat vector.
• ⏳ A concerning example found was a token with a maximum validity of 9,999 years, indicating a significant misconfiguration.

Vulnerabilities in PC Manager

• 🔍 Vulnerability ZDI-23-1527 involved an overly permissive SAS token for the WinGet package manager, allowing access to more resources than intended.
• 🚀 Vulnerability ZDI-23-1528 affected downloads from PC Manager's official domain, enabling attackers to upload malicious files like zip archives with attacker-controlled scripts or binaries.
• 🎭 This could lead to the distribution of compromised software, impacting the supply chain and other users.

Real-World Implications and Disclosure

• ⚠️ Attackers could exploit these vulnerabilities for information disclosure, spoofing attacks, or injecting malicious code into legitimate software downloads.
• 🤝 Trend Micro's Zero Day Initiative (ZDI) disclosed these issues to Microsoft, who responded by addressing the vulnerabilities through an online service update within approximately a week.
• 💡 The rapid response highlights Microsoft's mature vulnerability management process for online services.

Lessons for Cloud Security and Supply Chains

• 🛡️ Organizations should adhere to the principle of least privilege, granting only the necessary permissions for specific tasks.
• ☁️ It's crucial to understand the controls and configurations of cloud services, as cloud environments are not automatically secure.
• ✅ Maintaining up-to-date security patches remains a fundamental and effective defense against prevalent, known vulnerabilities, rather than rare zero-days.