Staying Sneaky in the Office (365)

Staying Sneaky in the Office (365)

Speakers: Christian Philipov

Conference: fwd:cloudsec North America 2025

YouTube: https://www.youtube.com/watch?v=l5lpIF_QZCE

Overview

Christian Philipov, a principal security consultant at WithSecure (formerly F-Secure), presented research into lesser-known SharePoint APIs that enable offensive operations while evading Microsoft's improving detection capabilities around Microsoft Graph. The talk delivered three practical findings: a SharePoint enumeration technique that avoids Graph API logging, a token exchange mechanism that mints access tokens for various Microsoft resources from within SharePoint, and a pre-authentication download bypass that circumvents both anonymous sharing restrictions and IP-based network access controls. All three techniques exploit legitimate SharePoint functionality that generates audit events indistinguishable from normal user activity, making detection extraordinarily difficult.

Background

▶ Watch: Research goals: avoiding Graph API and finding less-monitored SharePoint APIs (2:00)

Microsoft has been steadily improving its logging and detection capabilities around the Microsoft Graph API, the primary interface for interacting with Microsoft 365 services. As Graph activity monitoring matures, offensive operators need alternative paths that avoid its increasingly monitored endpoints. Philipov set out during an internal IT migration project at WithSecure (as the company separated from its former parent) to explore whether SharePoint's own APIs could provide enumeration, token exchange, and data access capabilities outside Graph's detection perimeter.

The research was motivated by three specific goals: avoid using Microsoft Graph wherever possible, discover quick enumeration methods for SharePoint on offensive engagements, and identify new attack primitives or defensive detection gaps. SharePoint's massive deployment footprint across enterprises and its inherently noisy operational profile -- users constantly browsing, searching, and downloading files -- make it an ideal place for an attacker to hide in plain sight.

Key Findings

▶ Watch: SP.Token.Acquire endpoint for minting access tokens from SharePoint cookies (8:00)

Finding 1: SharePoint Enumeration Without Graph. Philipov identified an API endpoint that retrieves lists of items from a provided relative URL within a SharePoint site. By supplying a basic body with required fields = true and the relevant FedAuth, rtFA, and SIM cookies (obtainable from user authentication endpoints), an attacker can enumerate all files in a SharePoint library without touching the Graph API. The response includes full file reference paths. This activity generates events in Office activity logs and unified audit logs but is indistinguishable from normal SharePoint search activity, making reliable detection nearly impossible through log analysis alone.

Finding 2: SharePoint Token Exchanges. SharePoint sites expose a /_api/SP.Token.Acquire endpoint that accepts a resource URL in the body and returns an access token for that resource along with its associated scopes. This allows an attacker to pivot from SharePoint cookies to access tokens for various Microsoft resources including specific SharePoint instances and other services. The returned tokens include scopes like Sites.Selected, User.Invite.All (potentially bypassing guest invitation restrictions), and User.RevokeSessions.All (useful for denial of service). While primarily read-only scoped, these tokens enable enumeration and lateral movement. Token refresh activity is visible in non-interactive Entra sign-in logs but is masked by SharePoint's natural token refresh behavior in normal browser sessions.

Finding 3: Pre-Authentication Download Bypass. This was the most impactful discovery. When a user opens or previews a file in SharePoint, the response JSON includes a downloadUrl field containing a temp authentication token -- effectively a pre-signed URL similar to AWS S3 pre-signed URLs. This URL bypasses two critical security controls: anonymous/external sharing restrictions (even when set to organization-only) and IP-based network access controls (SharePoint's conditional access by network location). Any user with read access to a file automatically generates these tokens in every request. The tokens are valid for approximately one hour and can be used from any IP address, any network, by anyone with the URL.

Microsoft's response to the MSRC disclosure classified the pre-authentication bypass as "low severity," stating they "do not consider this a security feature bypass" but rather "jumping a security guard rail." The feature is reportedly being deprecated but remains active.

Technical Deep Dive

▶ Watch: Pre-auth bypass circumvents anonymous sharing restrictions and IP-based controls (14:00)

The pre-authentication token uses a non-standard format. While it resembles a JWT (prefixed with v1 followed by Base64-encoded segments), it does not fully decode using standard JWT libraries. Partial decoding reveals a tie to a SharePoint user identity (distinct from Entra identity), an expiry claim, and additional claims that produce unintelligible data without knowledge of Microsoft's internal token decoding implementation. The token format was only documented in one place: a note within the PowerShell module documentation for SharePoint Online's Get-SPOTenantPreAuth cmdlet, which describes it as generating access tokens for "rich download scenarios" without standard authentication.

The SharePoint token exchange endpoint (SP.Token.Acquire) accepts specific resource URLs and returns tokens. Philipov confirmed it works for several resources including tenant-specific SharePoint instances. The endpoint has built-in limitations -- it does not mint tokens for arbitrary resources -- but the supported resource set is sufficient for enumeration and initial lateral movement.

All three techniques share a common detection challenge: the underlying API calls generate audit events that are functionally identical to normal SharePoint usage. Users browsing SharePoint, searching for files, and previewing documents all trigger the same log entries. Baselining might help, but the natural noise floor is high enough that any attacker exercising even modest operational discipline will blend in seamlessly.

Demo / Proof of Concept

▶ Watch: Finding the only documentation reference in PowerShell module docs (16:00)

No formal live demo was performed. Philipov walked through the API requests, responses, and bypass demonstrations using slides showing the actual HTTP requests and SharePoint configuration screens, including the Set-SPOTenant PowerShell command to disable the pre-authentication feature.

Defensive Implications

▶ Watch: One-command fix: Set-SPOTenant -PreAuthEnabled $false (20:00)

For the pre-authentication download bypass, the most effective mitigation is to disable the feature entirely using the PowerShell cmdlet: Set-SPOTenant -PreAuthEnabled $false. Philipov noted that he could find no legitimate use case for this feature and recommended disabling it in test environments first. This is a one-command fix that eliminates the most impactful finding.

For SharePoint enumeration and token exchanges, detection is possible but difficult. Defenders can monitor Office activity logs for file listing and access events, and non-interactive Entra sign-in logs for token refresh patterns. However, the noise from legitimate SharePoint usage makes reliable alerting challenging. Baselining user behavior and looking for statistical anomalies (volume, timing, breadth of enumeration) is the best available approach, though false positive rates will be significant.

Organizations should also review their SharePoint sharing settings to understand what controls they believe are in place versus what is actually enforced, particularly around anonymous sharing restrictions and network-based access controls.

Key Takeaways

• SharePoint's own APIs provide enumeration, token exchange, and data exfiltration capabilities that bypass Microsoft Graph detection entirely
• A pre-authentication download bypass generates pre-signed URLs that circumvent both organization-only sharing restrictions and IP-based network access controls
• The pre-authentication feature can be disabled with a single PowerShell command (Set-SPOTenant -PreAuthEnabled $false) and has no known legitimate use case
• SharePoint token exchange (SP.Token.Acquire) can mint access tokens for multiple Microsoft resources from cookies alone, enabling lateral movement
• All three techniques generate audit events indistinguishable from normal SharePoint usage, making detection extraordinarily difficult
• Microsoft classified the pre-authentication bypass as "low severity" and described it as "jumping a security guard rail" rather than a security feature bypass

About the Speaker(s)

Christian Philipov is a principal security consultant at WithSecure (formerly F-Secure), specializing in cloud security with a focus on Entra ID and Azure. He conducts offensive security engagements and security research, with a particular interest in discovering undocumented APIs and attack primitives in Microsoft's cloud ecosystem.