rules/findings/entra/app_registration/eid-application-with-unsafe-redirect-uri.json
|
{
"provider": "EntraID", "serviceType": "App Registrations", "serviceName": "Microsoft Entra ID", "displayName": "Ensure unsafe redirect URIs are removed from app registration", "description": "Redirect URIs are critical security components in OAuth 2.0 and OpenID Connect authentication flows, as they specify the locations where the Microsoft Entra authentication server sends users after successful authentication, along with authorisation codes or access tokens. When redirect URIs are improperly configured, they create significant vulnerabilities that can lead to authorisation code interception, access token theft, and complete account compromise.", "rationale": "Unsafe redirect URI configurations included the use of insecure HTTP schemes for non-localhost URIs (exposing tokens to network interception), wildcard patterns in URI definitions (such as https://*.company.com enabling attackers to redirect to any subdomain including attacker-controlled ones), URN schemes that do not follow absolute URI requirements specified in RFC 6749 section 3.1.2, redirect URIs pointing to domains no longer owned or controlled by the organisation (creating takeover opportunities), and excessively large lists of redirect URIs that increase the attack surface and make security audits more difficult.", "impact": "For applications using the implicit grant flow with unsafe redirect URIs, prioritise migration to the authorisation code flow with Proof Key for Code Exchange (PKCE), which is more resistant to token interception attacks. Implement additional security controls including mandatory use of the state parameter for CSRF protection, validation that redirect URIs match exactly (including case sensitivity and trailing slashes), monitoring of sign-in logs for unusual redirect patterns or failed validation attempts, and regular penetration testing specifically targeting OAuth redirect URI manipulation vulnerabilities.", "remediation": { "text": " ###### To remediate using the UI: 1. Navigate to Microsoft Entra admin centre https://entra.microsoft.com/. 2. Select App Registrations. 3. Search for the application with Redirect Uris. 4. Review and delete potential unsafe redirect uris. ", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/entra/identity-platform/reply-url", "https://learn.microsoft.com/en-us/entra/identity-platform/security-best-practices-for-app-registration", "https://datatracker.ietf.org/doc/html/rfc6819", "https://cwe.mitre.org/data/definitions/601.html" ], "compliance": [ { "name": "Monkey365 Entra", "version": "0.0.1", "reference": "5.3.1", "profile": [ ] } ], "level": "medium", "tags": [ ], "rule": { "path": "aad_app_registrations", "subPath": null, "selectCondition": { }, "query": [ { "filter": [ { "conditions": [ [ "web.redirectUris.Count", "gt", "0" ] ] } ] }, { "connectOperator":"and", "operator":"or", "filter": [ { "conditions": [ [ "{$_}", "like", 'http://*' ], [ "{$_}", "notlike", 'localhost*' ], [ "{$_}", "notlike", '127.0.0.1*' ] ], "operator":"and", "whereObject": "web.redirectUris" }, { "conditions": [ [ "{$_}", "like", '*azurewebsites.net*' ], [ "{$_}", "match", "\\*" ] ], "operator":"or", "whereObject": "web.redirectUris" } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "id": "Id", "appId": "Application Id", "displayName": "Application Name", "web.redirectUris": "URIs" }, "expandObject": null }, "table": "default", "decorate": [ ], "emphasis": [ ], "actions": { "objectData": { "properties": [ "*" ], "expandObject": null, "limit": null }, "showGoToButton": false, "showModalButton": true, "directLink": null } }, "text": { "data": { "properties": { "id": "Id", "appId": "Application Id", "displayName": "Application Name", "web.redirectUris": "URIs" }, "expandObject": null }, "status": { "keyName": [ "displayName" ], "message": "Ensure unsafe redirect URIs are removed from {displayName}", "defaultMessage": "Ensure unsafe redirect URIs are removed from app registrations" }, "properties": { "resourceName": "displayName", "resourceId": "id", "resourceType": "EntraApplication" }, "onlyStatus": false } }, "idSuffix": "aad_ap_registration_with_unsafe_redirect_uri", "notes": [ ], "categories": [ ], "immutable_properties": [ "id" ], "id": "entraid_1174" } |