SecBoard
Zurück zur CVE-Übersicht

CVE-2025-55241

CRITICAL(10.0)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Risk Signal Score25/100 — MITTEL
  • CVSS 10 — Kritisch

EPSS-Score

1.6%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

10

Technische Schwere

SecBoard-Einordnung

CVE-2025-55241 betrifft Microsoft Entra ID und ist eine Schwachstelle, die eine ermöglicht. Ein Angreifer könnte durch Ausnutzung dieser Schwachstelle höhere Berechtigungen innerhalb der betroffenen Systeme erlangen. Die genaue Methode der Ausnutzung und die vollständigen Auswirkungen sind derzeit noch nicht detailliert beschrieben.

KI-gestützte Einordnung auf Basis der NVD-Daten.

Beschreibung

Azure Entra ID Elevation of Privilege Vulnerability

Erkennung & Indikatoren

Ausnutzung

Microsoft says exploit code for these vulnerabilities is not yet available online.

Threat-Hunting-Queries

The vulnerability involves undocumented impersonation tokens ('Actor tokens') used for service-to-service communication and a critical flaw in the legacy Azure AD Graph API that failed to properly validate the originating tenant, allowing cross-tenant access. Requesting Actor tokens does not generate logs in the victim tenant, and the Azure AD Graph API lacks API-level logging. Therefore, detectio

Sentinel/Defender KQL

AuditLogs
| where OperationName in (
    "Add member to role",
    "Add user",
    "Update user",
    "Delete user",
    "Add group",
    "Update group",
    "Delete group",
    "Add application",
    "Update application",
    "Delete application",
    "Add service principal",
    "Update service principal",
    "Delete service principal",
    "Update policy",
    "Update device"
)
| where Result == "Success"
| extend InitiatingUser = tostring(InitiatedBy.user.userPrincipalName)
| extend InitiatingApp = tostring(InitiatedBy.app.displayName)
| where isempty(InitiatingUser) and isempty(InitiatingApp) // Look for operations without clear user/app context, or investigate unexpected operations
| project TimeGenerated, OperationName, InitiatingUser, InitiatingApp, TargetResources, ResultDescription, CorrelationId, Result

Splunk SPL

index=azure sourcetype=azure:aad:audit
| where OperationName IN (
    "Add member to role",
    "Add user",
    "Update user",
    "Delete user",
    "Add group",
    "Update group",
    "Delete group",
    "Add application",
    "Update application",
    "Delete application",
    "Add service principal",
    "Update service principal",
    "Delete service principal",
    "Update policy",
    "Update device"
)
| where Result="Success"
| eval InitiatingUser = coalesce(InitiatedBy.user.userPrincipalName, "N/A")
| eval InitiatingApp = coalesce(InitiatedBy.app.displayName, "N/A")
| where InitiatingUser="N/A" AND InitiatingApp="N/A" // Adjust as needed to filter for unexpected operations
| table _time, OperationName, InitiatingUser, InitiatingApp, TargetResources, ResultDescription, CorrelationId, Result

Sigma

title: Azure Entra ID Graph API Anomalous Modification
id: 7e0f2c1d-8b3a-4e5f-9d1c-0a2b3c4d5e6f
status: experimental
description: Detects suspicious modifications to Entra ID objects via the Azure AD Graph API, potentially indicating exploitation of CVE-2025-55241.
author: SecBoard
date: 2024/07/30
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    OperationName:
      - 'Add member to role'
      - 'Add user'
      - 'Update user'
      - 'Delete user'
      - 'Add group'
      - 'Update group'
      - 'Delete group'
      - 'Add application'
      - 'Update application'
      - 'Delete application'
      - 'Add service principal'
      - 'Update service principal'
      - 'Delete service principal'
      - 'Update policy'
      - 'Update device'
    Result: 'Success'
  filter_no_initiator:
    InitiatedBy.user.userPrincipalName: null
    InitiatedBy.app.displayName: null
  condition: selection and filter_no_initiator
fields:
  - OperationName
  - InitiatedBy.user.userPrincipalName
  - InitiatedBy.app.displayName
  - TargetResources
  - ResultDescription
level: high

Elastic ES|QL

from auditlogs
| where OperationName in (
    "Add member to role",
    "Add user",
    "Update user",
    "Delete user",
    "Add group",
    "Update group",
    "Delete group",
    "Add application",
    "Update application",
    "Delete application",
    "Add service principal",
    "Update service principal",
    "Delete service principal",
    "Update policy",
    "Update device"
)
| where Result == "Success"
| extend InitiatingUser = InitiatedBy.user.userPrincipalName
| extend InitiatingApp = InitiatedBy.app.displayName
| where is_null(InitiatingUser) and is_null(InitiatingApp) // Look for operations without clear user/app context
| project @timestamp, OperationName, InitiatingUser, InitiatingApp, TargetResources, ResultDescription, CorrelationId, Result

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Betroffene Produkte

  • cpe:2.3:a:microsoft:entra_id:-:*:*:*:*:*:*:*

Referenzen