ConsentFix and Mitigation

 

What is ConsentFix?

ConsentFix is a sophisticated attack that exploits the OAuth 2.0 authorization code flow, a legitimate mechanism used by applications like Azure CLI and PowerShell to authenticate users. Instead of breaking passwords or bypassing MFA through brute force, attackers manipulate this trusted flow to steal authorization codes, which can then be exchanged for access tokens granting entry to Microsoft Entra resources. 

---

How Does It Work?

1. Malicious Login URI
   Attackers craft a Microsoft Entra login URL targeting trusted apps (e.g., Azure CLI) and resources (e.g., Azure Resource Manager).

2. User Interaction
   Victims are lured to a phishing page or malicious site that triggers this login flow. After successful authentication, the browser redirects to a localhost URI (e.g., http://localhost:<port>), which normally would be handled by the legitimate app.

3. Authorization Code Exposure
   Because no app is listening on localhost, the browser shows an error—but the authorization code remains in the URL. Attackers trick users into copying or dragging this URL into a malicious form.

4. Token Redemption
   The attacker redeems the stolen code within ~10 minutes to obtain bearer tokens, granting access to Microsoft Entra resources without needing passwords or triggering MFA. 

---

Why It Bypasses Conditional Access & MFA

• The attack leverages legitimate OAuth flows, so MFA and Conditional Access policies don’t block it.
• Tokens obtained are valid and scoped for resources like Azure and Microsoft 365, enabling full programmatic access. 

---

Detection Challenges

• Sign-in logs show two events:
  • Interactive sign-in (victim)
  • Non-interactive sign-in (attacker)
• These can be correlated by SessionId and ApplicationId, but timing and IP mismatches are key indicators.
• False positives can occur in legitimate cloud dev environments (e.g., GitHub Codespaces). 

---

Mitigation Strategies

• Monitor Entra ID sign-in logs for anomalies (e.g., mismatched IPs, rapid token redemption).
• Implement OAuth flow hardening: enforce strict redirect URI validation and educate users about phishing tactics.
• Consider conditional access policies that restrict OAuth flows for high-risk apps. 

---

Key Defensive Measures Against ConsentFix

• Restrict Redirect URIs: Enforce strict validation for OAuth redirect URIs to prevent localhost-based exploits.
• Limit OAuth Permissions: Review and minimize app permissions, especially for high-privilege apps like Azure CLI.
• Educate Users: Train users to avoid copying URLs from error pages or phishing prompts.
• Conditional Access Hardening: Apply policies that restrict OAuth flows for sensitive apps or require device compliance.
• Monitor Token Lifetimes: Reduce authorization code validity and enforce short-lived tokens where possible.

---

Quick Detection Checklist for Microsoft Entra Logs

• Look for Paired Events:
  • Interactive sign-in (victim) followed by non-interactive sign-in (attacker).
• Check SessionId & ApplicationId:
  • Correlate both events for matching IDs.
• IP Address Mismatch:
  • Victim and attacker IPs differ significantly.
• Timing:
  • Token redemption occurs within ~10 minutes of user sign-in.
• Unusual Redirect URIs:
  • Requests involving http://localhost:<port>.