Exploiting Overly Permissive SAS Tokens in Microsoft PC Manager Supply Chain

Understanding Microsoft PC Manager

• 🎯 Microsoft PC Manager is a tool designed for remote PC management, enabling administrators to control storage, manage pop-ups, and generally oversee systems within their purview.
• 🔑 It functions as a defensive and system administration tool, offering significant control over managed devices.

The Risk of Overly Permissive SAS Tokens

• ⚠️ Shared Access Signature (SAS) tokens are intended to grant limited access to Azure storage resources, specifying access for individuals to particular resources.
• ⚡ When misconfigured or overly permissive, these tokens can be abused by attackers to alter software packages or inject malicious code, transforming a helpful feature into a supply chain threat vector.
• ⏳ A concerning example found was a token with a maximum validity of 9,999 years, highlighting a severe misconfiguration.

Vulnerabilities in WinGet and PC Manager Downloads

• 🧩 The research identified two vulnerabilities: ZDI-23-1527 and ZDI-23-1528, related to overly permissive SAS tokens.
• 🔍 The first vulnerability involved the WinGet package manager, where an overly permissive token allowed access to more resources than intended, potentially leading to information disclosure or data manipulation.
• 🚀 The second scenario, concerning downloads from PC Manager.microsoft.com, allowed for the upload of malicious files, such as zip files containing attacker-controlled scripts or binaries, thereby compromising the supply chain for other users.

Real-World Implications and Mitigation

• 💡 Potential real-world implications include the distribution of compromised packages through Microsoft's site, impacting numerous users.
• 🎭 Attackers could also engage in spoofing information to make malicious data appear legitimate, or conduct information disclosure by downloading sensitive data.
• ✅ The primary lesson is to adhere to the principle of least privilege, granting only the necessary permissions for a task.

Best Practices for Supply Chain Security

• 🛡️ Organizations should stay up-to-date on security patches, as unpatched vulnerabilities are far more common than zero-days.
• 🤝 It is crucial to understand shared responsibility in cloud environments, clarifying who is accountable for applying updates and managing security configurations between the user and the service provider.
• 💬 The importance of coordinated disclosure between security researchers, vendors, and software providers is highlighted as a method to fix vulnerabilities before public exposure, reducing risk to end-users.