Microsoft OneDrive File Picker Flaw Grants Apps Full Cloud Access
Researchers studying cybersecurity have found a vulnerability in Microsoft's OneDrive File Picker that, if properly abused, may provide websites access to a user's whole cloud storage collection rather than simply the files they have chosen to upload using the tool.
In a report shared with The Hacker News, the Oasis Research Team stated that this is due to deceptive permission screens that do not explicitly indicate the level of access being allowed, as well as too large OAuth scopes. Customer data leakage and regulatory violations are just two of the serious repercussions that could result from this defect.
Because of their interface with Microsoft's cloud service, it is estimated that a number of apps, including ChatGPT, Slack, Trello, and ClickUp, are impacted.
The issue, acco...