Reports say the attackers don’t require permissions to read these files and it impacts all commercial and GCC Desktop Teams clients for Windows, Mac, and Linux. Vectra reported this issue to Microsoft but they said it did not meet their bar for immediate servicing.
Severe Security Flaws in the Desktop App for Microsoft Teams
Microsoft Teams is a proprietary business communication platform developed by Microsoft, as part of the Microsoft 365 family of products. Teams primarily compete with the similar service Slack, offering workspace chat and videoconferencing, file storage, and application integration.
Generally Microsoft Teams App stores authentication tokens in ‘cleartext’ and with these tokens, attackers can guess the token holder’s identity for any actions possible through the Microsoft Teams client.
“The desktop application creates opportunities for attackers to use credentials outside their intended context because, unlike modern browsers, there are no additional security controls to protect cookie data”, Vectra
Experts also mention that attackers can conduct communications within an organization. Assuming full control of critical seats–like a company’s Head of Engineering, CEO, or CFO—attackers can convince users to perform tasks damaging to the organization.
Researcher recommends using the web-based Teams client inside Microsoft Edge, which has multiple OS-level controls to protect token leaks. Linux users, move to a different collaboration suite, particularly since Microsoft announced plans to stop supporting the app for the platform by December.