cyber.hendryadrian.com
Cyber Attack & Data Breach · securityonline.info

Trend Micro Details SharePoint Data Theft Enabled by Exposed Spring Boot Actuator

· Original article ↗

Summary

Trend Micro describes attackers using an exposed Spring Boot Actuator endpoint, plaintext Azure AD application secrets and the ROPC flow to obtain a token and exfiltrate files from SharePoint Online.

Key points

  • Trend Micro's case study says exposed /env and /configprops endpoints revealed a SharePoint service account and host URL.
  • Investigators found Azure AD application client IDs and secrets stored in a spreadsheet in plaintext.
  • Attackers reportedly used the ROPC flow to obtain an Azure AD access token without additional security challenges such as MFA.
  • Using valid API access and no malware, attackers reportedly enumerated SharePoint libraries and downloaded sensitive files.
  • The article names Mail.sql, Credential.txt and VPN_Exception.xlsx among the files reportedly exfiltrated.
  • Recommendations include restricting Actuator access, auditing for plaintext secrets and disabling ROPC when it is not required.

Article Details

Victim Organization
Not disclosed
Victim Domain
Not disclosed
Incident Type
Data exfiltration from SharePoint Online following exposure of Spring Boot Actuator endpoints and abuse of credentials through the ROPC flow.
Data Types Exposed
  • Sensitive files, including Mail.sql, Credential.txt, and VPN_Exception.xlsx; their contents were not specified.
Affected Records
Not disclosed
Affected Data Size
Not disclosed
Operational Impact
Document libraries were enumerated, and sensitive files were downloaded and exfiltrated using valid API access. No service disruption was reported.
Ransom Or Extortion
None reported
Claim Status
confirmed

MITRE ATT&CK

T1078.004 · Cloud AccountsThe attackers used credentials to obtain an Azure AD access token and access SharePoint Online.T1552.001 · Credentials In FilesClient IDs and client secrets were stored in a spreadsheet, exposing credentials in a file.

Products

Azure ADAttackers combined plaintext client secrets from a spreadsheet with the ROPC flow to obtain an Azure AD access token and use valid API calls to exfiltrate files from SharePoint Online.SharePoint OnlineAttackers combined plaintext client secrets from a spreadsheet with the ROPC flow to obtain an Azure AD access token and use valid API calls to exfiltrate files from SharePoint Online.Spring Bootincident caused by simple misconfigurations and poor credential hygiene, beginning with an exposed Spring Boot Actuator endpoint that revealed a SharePoint service account and host URL.

Related Articles