Podcast Detail

SANS Stormcast Friday, August 21st, 2026: Microsoft Graph and Powershell; Keycloak Vuln; Cryptographic Context Injection; N-Able Password Leak

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10062.mp3

previous
Podcast Logo
Microsoft Graph and Powershell; Keycloak Vuln; Cryptographic Context Injection; N-Able Password Leak
00:00

My Next Class

Click HERE to learn more about classes Johannes is teaching for SANS

Podcast Transcript

 Hello and welcome to the Friday, August 21st, 2026
 edition of the SANS Internet Storm Center's Stormcast. My
 name is Johannes Ullrich, recording today from
 Jacksonville, Florida. And this episode is brought to you
 by the SANS.edu graduate certificate program in
 industrial control system security. Well, today we did
 not just get one, but two great diaries from Rob about
 how to use PowerShell to automate various tasks with
 Microsoft Graph. Microsoft Graph is Microsoft's new
 standard API to interact with its services, in particular,
 of course, with Entra, which is responsible for Microsoft's
 authentication and access control. And well, nothing
 more important to access control than tracking stale
 accounts. So the first script that Rob presents here is
 collecting all users with stale accounts that basically
 haven't logged in in a while, but also lists any licenses
 assigned to different users. The second script that Rob
 shows here in the second diary today does look at the risk
 detection within Entra. Entra can mark certain activity as
 risky, and this PowerShell script does collect all users
 that triggered one of these alerts, plus details regarding
 the reason why the activity was considered risky. Some of
 them is just, for example, using an unusual browser for
 the particular user based on the user agent, but then also
 geographic origin or internet origin. So basically based on
 ASN, which of course often also then maps to specific
 geographies. Interesting PowerShell scripts, and I
 always love myself some automation. Personally, not a
 big PowerShell person, but given that you're dealing here
 with Microsoft's ecosystem, of course, there's a lot of
 support for PowerShell in particular when it comes to
 various libraries to interact with the Microsoft to retrieve
 all this data. And Keycloak released a new version 26.7.2
 fixing a number of security vulnerabilities. One of them
 is particularly interesting and thanks to listener Daniel
 for alerting me of this. I would have probably missed it
 otherwise. This is a password reset issue that was addressed
 here. An unabot unauthenticated user is able
 to reset any user's password. And the underlying problem
 here is that the well, basically password reset with
 Keycloak works like with many other systems where it sends
 you an email with a verification token. You have
 to click on that link to then reset your password. The
 problem is that the token isn't actually validated
 properly by Keycloak. And as a result, an attacker can
 essentially just spoof that token and reset the password
 without ever seeing the email. Keycloak is an identity access
 management system. It's heavily used by Red Hat. Red
 Hat also supports the development of a Keycloak. So
 definitely sort of the underpinning identity access
 management system for a lot of other products and web
 applications. Definitely if you're using Keycloak, get
 this updated. Keycloak is an identity access management
 system. And the blog post by Ronnie Utevsky demonstrates an
 interesting way to bypass safeguards in large language
 models. Ronnie calls this cryptographic context
 injection and really what it comes down to is that when
 you're sending a request to a chatbot, an LLM, it usually
 goes first through a filter to look if this is some kind of
 malicious or not allowed request. And then it's being
 passed to the actual engine that will act on this request.
 Well, the trick here is that the request is encrypted and
 then the LLM is being told how to decrypt it. But the
 decryption happens after it goes through the initial
 stage, the actual guardrail stage. And of course, during
 the guardrail check, the content is encrypted and it
 has no idea what it's actually doing here. This is a very
 classic bad pattern that we see a lot where you do
 basically your input validation before you do any
 kind of input manipulation. You always have to do your
 input validation after any kind of normalization and
 other kind of transformation of the input is performed. And
 well, this sort of basic step is reversed here. We've got
 another vulnerability in an N-able product, but this time
 nothing for you to patch. N-Able already took care of it
 for you. This affects the Passportal password manager.
 Now N-able, they make a lot of products for managed service
 providers. And of course, managed service providers need
 to have access to credentials in order to manage their
 clients' networks. The problem here is that the Passportal
 doesn't really interact well with the browser extension
 that is being used to retrieve passwords from Passportal. The
 interaction between the two components happens via
 standard across window messaging, standard JavaScript
 APIs. This works cross origin, but the Passportal didn't
 properly check the origin where the request came from.
 And the result was that basically any website was able
 to interface with Passportal and retrieve passwords. Given
 that managed service providers are really sort of a big focus
 of current attacks, because once you broke a managed
 service provider, you essentially also broke into
 all of their clients. This is certainly a very critical
 vulnerability. Luckily, N-Able was able to patch this within
 hours of the vulnerability being reported. Well, and
 that's it for today. Remember, the show notes also include a
 link to classes I'm teaching. And the Defending Web
 Application Security class actually covers two of the
 stories that we had today. KeyClock is a tool that we
 actually use in the class. And we also talk about Passport
 Reset, of course. And regarding the N-Able Password
 Manager issue, well, we actually have an exercise
 where we talk about the cross -window messaging and the
 JavaScript APIs and exactly sort of these origin issues
 that may happen there. That's it for today. Thanks and talk
 to you again on Monday. Bye.
 Bye.