CVE-2024-21632: Omniauth Microsoft Graph Auth Bypass Flaw

CVE-2024-21632 Overview

CVE-2024-21632 is a critical authentication bypass vulnerability in the omniauth-microsoft_graph Ruby gem, which provides an OmniAuth strategy for the Microsoft Graph API. Prior to version 2.0.0, the implementation failed to validate the legitimacy of the email attribute returned by Microsoft during the OAuth authentication flow. This lack of validation makes the library susceptible to nOAuth misconfiguration attacks when applications use the email field as a trusted user identifier, potentially leading to complete account takeover.

Critical Impact
Attackers can exploit unvalidated email claims in OAuth responses to impersonate legitimate users and gain unauthorized access to their accounts, leading to complete account takeover scenarios.

Affected Products

omniauth-microsoft_graph versions prior to 2.0.0
Ruby applications using omniauth-microsoft_graph for Microsoft Graph API authentication
Applications relying on unvalidated email claims for user identification

Discovery Timeline

2024-01-02 - CVE-2024-21632 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-21632

Vulnerability Analysis

This vulnerability falls under CWE-287 (Improper Authentication) and represents a significant security flaw in the OAuth authentication flow implementation. The omniauth-microsoft_graph library, prior to version 2.0.0, did not validate whether the email attribute returned by Microsoft during the OAuth flow was legitimate or verified. This is particularly dangerous in environments where Azure AD tenants allow unverified email addresses to be set on user profiles.

The core issue stems from a pattern known as "nOAuth" - a misconfiguration where OAuth identity providers can return user-controlled email values that downstream applications trust implicitly. When an application uses this unvalidated email as the primary identifier for user accounts, an attacker can register with a malicious Azure AD tenant, set their email to match a target user's email, and authenticate to gain access to the victim's account.

Root Cause

The root cause of CVE-2024-21632 is the absence of email verification logic within the OmniAuth strategy implementation. The library passed through the email claim from Microsoft Graph API responses without:

Verifying that the email address is confirmed/validated by Microsoft
Providing documentation or configuration options for applications to implement their own validation
Warning developers about the security implications of trusting unvalidated email claims

This design oversight allowed malicious actors to exploit the trust relationship between the application and the identity provider.

Attack Vector

The attack vector for this vulnerability is network-based and requires no privileges or user interaction. An attacker can exploit this vulnerability through the following attack flow:

The attacker identifies a target application using omniauth-microsoft_graph for authentication
The attacker creates or uses an Azure AD tenant that allows setting arbitrary email addresses
The attacker sets their Azure AD profile email to match a legitimate user's email address in the target application
The attacker authenticates to the target application using their Azure AD credentials
The vulnerable omniauth-microsoft_graph library passes the unvalidated email to the application
The application associates the session with the victim's account based on the spoofed email

For more technical details on the nOAuth attack pattern, see the Descope blog post on nOAuth.

Detection Methods for CVE-2024-21632

Indicators of Compromise

Multiple login events from different Azure AD tenant IDs for the same user account
Authentication events where the email claim does not match the expected tenant or organization
Unusual account access patterns following OAuth authentication
Log entries showing email claim mismatches between user profile and authentication response

Detection Strategies

Monitor authentication logs for users authenticating from unexpected Azure AD tenants
Implement alerting on account access from new OAuth identity providers
Audit application dependencies to identify vulnerable versions of omniauth-microsoft_graph (< 2.0.0)
Review application code for reliance on unvalidated email claims for user identification

Monitoring Recommendations

Enable detailed logging for OAuth authentication flows including tenant ID and email claims
Set up alerts for authentication anomalies such as email domain mismatches
Monitor for multiple accounts sharing the same email identifier
Implement periodic dependency scanning to detect vulnerable gem versions

How to Mitigate CVE-2024-21632

Immediate Actions Required

Upgrade omniauth-microsoft_graph to version 2.0.0 or later immediately
Audit user accounts for potential unauthorized access or account takeover incidents
Review authentication logs for suspicious OAuth authentication patterns
Implement additional email verification mechanisms independent of the OAuth flow
Consider restricting authentication to known/trusted Azure AD tenants

Patch Information

The vulnerability has been fixed in omniauth-microsoft_graph version 2.0.0. The patch introduces proper validation of the email attribute to prevent nOAuth attacks. The fix is available in the GitHub commit f132078389612b797c872b45bd0e0b47382414c1. For complete details about the vulnerability and remediation, see the GitHub Security Advisory GHSA-5g66-628f-7cvj.

Workarounds

Avoid using the email claim as the sole identifier for user accounts
Implement server-side validation of email domain against allowed tenant configurations
Restrict OAuth authentication to specific, trusted Azure AD tenant IDs
Add secondary verification steps before associating OAuth identities with existing accounts

bash

# Update omniauth-microsoft_graph to patched version
bundle update omniauth-microsoft_graph

# Or specify minimum version in Gemfile
# gem 'omniauth-microsoft_graph', '>= 2.0.0'