Azure AD Vulnerability Leaks Credentials, Lets Attackers Deploy Malicious Apps

During a cybersecurity assessment, according to Resecurity’s HUNTER Team, researchers found a publicly accessible appsettings.json file in an ASP.NET Core app that exposed the ClientId and ClientSecret of an Azure AD application. This misconfiguration allowed attackers to authenticate directly against Microsoft’s OAuth 2.0 endpoints and obtain a Bearer token via the Client Credentials flow, effectively granting trusted-application access.

With the leaked credentials, the token could be used to call Microsoft Graph APIs to retrieve data from SharePoint, OneDrive, and Exchange Online, enumerate users, groups and directory roles, and potentially grant further permissions or deploy malicious applications under the tenant.

The exposure arose because the file was served without access controls, enabling automated crawlers or determined adversaries to harvest secrets and compromise cloud accounts, exfiltrate data, or move laterally into production services. The report urges organisations to enforce strict file-access controls, exclude configuration files from public hosting, and adopt robust secret management practices, including migrating secrets to secure vaults and implementing automated scanning for exposed credentials. The piece was published on 2 September 2025.