CVE-2024-21632: Omniauth Microsoft Graph Auth Bypass Flaw

CVE-2024-21632 Overview

CVE-2024-21632 is a critical authentication bypass vulnerability in the omniauth-microsoft_graph Ruby gem, which provides an OmniAuth strategy for the Microsoft Graph API. Prior to version 2.0.0, the implementation failed to validate the legitimacy of the email attribute returned by Microsoft during the OAuth authentication flow. This lack of validation makes the library susceptible to nOAuth misconfiguration attacks when applications use the email field as a trusted user identifier, potentially leading to complete account takeover.

Critical Impact

Attackers can exploit unvalidated email claims in OAuth responses to impersonate legitimate users and gain unauthorized access to their accounts, leading to complete account takeover scenarios.

Affected Products

• omniauth-microsoft_graph versions prior to 2.0.0
• Ruby applications using omniauth-microsoft_graph for Microsoft Graph API authentication
• Applications relying on unvalidated email claims for user identification

Discovery Timeline

• 2024-01-02 - CVE-2024-21632 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-21632

Vulnerability Analysis

This vulnerability falls under CWE-287 (Improper Authentication) and represents a significant security flaw in the OAuth authentication flow implementation. The omniauth-microsoft_graph library, prior to version 2.0.0, did not validate whether the email attribute returned by Microsoft during the OAuth flow was legitimate or verified. This is particularly dangerous in environments where Azure AD tenants allow unverified email addresses to be set on user profiles.

The core issue stems from a pattern known as "nOAuth" - a misconfiguration where OAuth identity providers can return user-controlled email values that downstream applications trust implicitly. When an application uses this unvalidated email as the primary identifier for user accounts, an attacker can register with a malicious Azure AD tenant, set their email to match a target user's email, and authenticate to gain access to the victim's account.

Root Cause

The root cause of CVE-2024-21632 is the absence of email verification logic within the OmniAuth strategy implementation. The library passed through the email claim from Microsoft Graph API responses without:

1. Verifying that the email address is confirmed/validated by Microsoft
2. Providing documentation or configuration options for applications to implement their own validation
3. Warning developers about the security implications of trusting unvalidated email claims

This design oversight allowed malicious actors to exploit the trust relationship between the application and the identity provider.

Attack Vector

The attack vector for this vulnerability is network-based and requires no privileges or user interaction. An attacker can exploit this vulnerability through the following attack flow:

1. The attacker identifies a target application using omniauth-microsoft_graph for authentication
2. The attacker creates or uses an Azure AD tenant that allows setting arbitrary email addresses
3. The attacker sets their Azure AD profile email to match a legitimate user's email address in the target application
4. The attacker authenticates to the target application using their Azure AD credentials
5. The vulnerable omniauth-microsoft_graph library passes the unvalidated email to the application
6. The application associates the session with the victim's account based on the spoofed email

For more technical details on the nOAuth attack pattern, see the Descope blog post on nOAuth.

Detection Methods for CVE-2024-21632

Indicators of Compromise

• Multiple login events from different Azure AD tenant IDs for the same user account
• Authentication events where the email claim does not match the expected tenant or organization
• Unusual account access patterns following OAuth authentication
• Log entries showing email claim mismatches between user profile and authentication response

Detection Strategies

• Monitor authentication logs for users authenticating from unexpected Azure AD tenants
• Implement alerting on account access from new OAuth identity providers
• Audit application dependencies to identify vulnerable versions of omniauth-microsoft_graph (< 2.0.0)
• Review application code for reliance on unvalidated email claims for user identification

Monitoring Recommendations

• Enable detailed logging for OAuth authentication flows including tenant ID and email claims
• Set up alerts for authentication anomalies such as email domain mismatches
• Monitor for multiple accounts sharing the same email identifier
• Implement periodic dependency scanning to detect vulnerable gem versions

How to Mitigate CVE-2024-21632

Immediate Actions Required

• Upgrade omniauth-microsoft_graph to version 2.0.0 or later immediately
• Audit user accounts for potential unauthorized access or account takeover incidents
• Review authentication logs for suspicious OAuth authentication patterns
• Implement additional email verification mechanisms independent of the OAuth flow
• Consider restricting authentication to known/trusted Azure AD tenants

Patch Information

The vulnerability has been fixed in omniauth-microsoft_graph version 2.0.0. The patch introduces proper validation of the email attribute to prevent nOAuth attacks. The fix is available in the GitHub commit f132078389612b797c872b45bd0e0b47382414c1. For complete details about the vulnerability and remediation, see the GitHub Security Advisory GHSA-5g66-628f-7cvj.

Workarounds

• Avoid using the email claim as the sole identifier for user accounts
• Implement server-side validation of email domain against allowed tenant configurations
• Restrict OAuth authentication to specific, trusted Azure AD tenant IDs
• Add secondary verification steps before associating OAuth identities with existing accounts

# Update omniauth-microsoft_graph to patched version
bundle update omniauth-microsoft_graph

# Or specify minimum version in Gemfile
# gem 'omniauth-microsoft_graph', '>= 2.0.0'