Description

Azure Active Directory Graph API services can be accessed and used from anywhere on the Internet. Note: the URL of the service as well as the credentials to use it were found in the application code.

Impact

- Access to confidential information from any computer on the Internet. - Edit information from any computer on the Internet.

Recommendation

Verify Azure documentation regarding Conditional Access policy and securely configure the service by establishing trusted locations to access the service.

Threat

Authorized user from the Internet.

Expected Remediation Time

⏱️ 60 minutes.

Requirements

Fixes