The Master Key: Exposed JSON File Gives Attackers Full Control of Azure AD

Resecurity’s HUNTER Team uncovered a severe misconfiguration: sensitive Azure Active Directory credentials were exposed in a publicly accessible appsettings.json file. According to Resecurity, with these credentials an attacker can authenticate directly against Microsoft’s OAuth 2.0 endpoints, masquerading as the trusted application.

The exposure allows attackers to obtain valid OAuth 2.0 tokens and, using those tokens, grant programmatic access to Microsoft Graph to enumerate users, groups and directory roles, exfiltrate data from SharePoint, OneDrive and Exchange Online, deploy rogue applications within the tenant and escalate privileges by exploiting over‑permitted roles.

The findings emphasise that exposing appsettings.json with Azure AD secrets is not just a misconfiguration but an attack vector that directly hands adversaries the keys to the cloud. Resecurity recommends immediate steps such as restricting file access, removing plaintext secrets and rotating compromised credentials, applying least privilege and enabling Azure AD logging for unusual service principal activity.

The article notes that attackers continually crawl websites, scan GitHub repos and use tools to locate this type of leak, underscoring the urgent need for better secrets management.