Rogue Azure AD Guests Can Steal Data via Power Apps
A few default guest setting manipulations in Azure AD and over-promiscuous low-code app developer connections can upend data protections.
Michael Bargury
Security research, hacking, AppSec, primarily focused on low-code/no-code apps.
You May Also Enjoy
Safe Web Browsing for Copilots
1 minute read
Allowing a copilot to search the web at will is extremely dangerous. Here are two somewhat-understood vulnerabilities and how to mitigate them. Note: this is...
Followup links for All You Need Is Guest RSAC 2024
less than 1 minute read
Assorted links for All You Need Is Guest @ RSAC 2024:
Power Platform DLP Bypass via Copy-And-Paste
6 minute read
Last August I gave a talk at BlackHat USA titled All You Need Is Guest. In it, I showed how simple guest access to EntraID could be escalated into full contr...
All You Need Is Guest
7 minute read
This is a long overdue blog version of a talk I gave at BlackHat USA 2023 titled All You Need Is Guest. Slides and video recording are available as well.