H3-2024-0039
Microsoft Graph App Role Privilege Elevation
| Category | SECURITY_MISCONFIGURATION |
| Base Score | 5.9 |
Description
The Microsoft Graph API service provides a secondary set of Role-Based Access Controls (RBACs) in Entra ID that can be assigned to Entra objects called app roles. Two of these permissions, AppRoleAssignment.ReadWrite.All and RoleManagement.ReadWrite.Directory, allow the assigned object to arbitrarily assign additional app roles to itself or other objects.
Impact
If an attacker is able to compromise an Entra ID credential with the MS Graph AppRoleAssignment.ReadWrite.All or RoleManagement.ReadWrite.Directory app role they can assign themselves the RoleManagement.ReadWrite.Directory role -- letting them arbitrarily assign the Global Administrator Directory Role.