📙 Red Teaming from outside: Identifying and exploiting SaaS systems for access 🏗️

by Rojan Rijal

Day 1 · AMC Theatre 09 · 🔥 D&R · 39 min · 3 min read

Offensive Security Cloud Security

TL;DR

Rijal demonstrated two attack chains against email security vendors and Google Groups. The first abused unauthenticated GET requests from vendor URL scanners to auto-verify Atlassian accounts, gaining access to Netflix's internal Jira. The second used a recruiting platform's email flow to join internal Google Groups from outside, exfiltrating all group emails. Both chains relied on misconfigured permission settings.

Abusing Email Security Vendor URL Scanners

▶ Watch (2:04)

Email security vendors like Mimecast and Proofpoint scan reported phishing emails. They send unauthenticated GET requests to URLs in those emails. Rijal reversed that process. He used Amazon SES to create a verified email identity for phishing@netflix.com. He then signed up for Atlassian with that address. Atlassian sent a verification link. Netflix’s phishing report system automatically unfurled the link, verifying the account. Rijal then joined Netflix’s internal Jira and Confluence workspaces through Atlassian’s domain capture feature.

Exploiting Google Groups with Email Commands

▶ Watch (17:01)

Google Groups have email commands like +subscribe. Sending an email to group+subscribe@company.com triggers a join process. Rijal found that even private groups (hidden from the UI) could be joined via email if the group’s permission was set to “anyone in the organization can join.” The private setting only hides the group from search. It does not block the email command. He confirmed group existence by banning the group’s email from a public Google Group, which returned the group name and link.

Joining Internal Groups via Recruiting Platforms

▶ Watch (27:34)

Rijal targeted a recruiting platform. He created a job and added a candidate. The platform sent an interview email from the company’s domain. The candidate’s reply went to an inbound email address controlled by the job. Rijal changed the candidate’s email to internal+subscribe@company.com. The platform sent the subscribe command from the company’s domain. Google Groups accepted it because the SPF and DKIM passed. The group sent back a confirmation code. Rijal then changed the candidate’s email to internal+subconfirm@company.com and replied with the code. The inbound email address was added to the internal group’s mailing list, exfiltrating all future emails.

Q&A

How vulnerable are other SaaS providers like Microsoft 365 compared to Google Groups? Rijal did not investigate Office 365 groups and could not provide a direct comparison. ▶ 38:03

Notable Quotes

“it will then send that email a link to click to verify it owns it. If it’s clicked, then it’s automatically verified.” Rojan Rijal · ▶ 6:10

“the third one however is interesting where it just sends you a confirmation code and you respond to it and you will most likely be able to join.” Rojan Rijal · ▶ 18:57

“even though the setting is private you cannot see it you still add your email address to the mailing list which allows you to then see all the incoming emails” Rojan Rijal · ▶ 19:21

Key Takeaways

Email security vendor URL scanners can auto-verify attacker-controlled accounts.
Google Groups email commands bypass the private UI setting for joining.
Recruiting platforms can be weaponized to send subscribe commands from a company’s domain.

Filed under

Offensive Security Cloud Security