PT-2024-21638 · Microsoft · Msal.Net

Ntc-Swiss-Team · Published 2024-04-16 · Updated 2024-04-17 · CVE-2024-27086

Positive Technologies (AI Summary)

CVSS v3.1

3.9

Low

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions MSAL.NET versions 4.48.0 through 4.60.0

Description A malicious application running on a customer Android device can cause local denial of service against applications that were built using MSAL.NET for authentication on the same device, due to incorrect activity export configuration. This can prevent the user of the legitimate application from logging in. Additionally, a malicious application can inject HTML/JavaScript in an embedded web view exported by affected applications.

Recommendations For MSAL.NET versions 4.48.0 through 4.60.0, update to MSAL.NET version 4.60.1 or later to resolve the issue. As a temporary workaround, developers may explicitly mark the MSAL.NET activity non-exported by setting android:exported="false" in the activity configuration.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

CWE-926

Related Identifiers

CVE-2024-27086

GHSA-X674-V45J-FWXW

Affected Products

Msal.Net

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27086.json · Exploit
• https://osv.dev/vulnerability/GHSA-x674-v45j-fwxw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27086 · Security Note
• https://osv.dev/vulnerability/CVE-2024-27086 · Vendor Advisory
• https://github.com/AzureAD/microsoft-authentication-library-for-dotnet · Note
• https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/commit/413e319472ccf48c86647f19fa2aa49ff6038488 · Note
• https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/security/advisories/GHSA-x674-v45j-fwxw · Note
• https://twitter.com/CVEnew/status/1780354165438607839 · Twitter Post
• https://nuget.org/packages/Microsoft.Identity.Client · Note
• https://learn.microsoft.com/en-us/entra/msal/dotnet · Note