Nice2Meet: We Turned Teams Mobile Meetings Into a Silent Account Takeover
Enclave researchers discovered that the Microsoft Teams Mobile whiteboard feature's changeWhiteboardUrl event handler calls loadUrl() directly without domain validation, bypassing the shouldOverrideUrlLoading hook that enforces the domain allowlist. An attacker in a Teams meeting can redirect all mobile participants' whiteboard WebViews to an attacker-controlled page, which has access to the nativeInterface JavaScript bridge. The bridge exposes authentication.getAuthToken, enabling theft of Microsoft 365 tokens with broad scopes (Mail.ReadWrite, Mail.Send, Files.ReadWrite.All, Calendars.ReadWrite, SharePoint Sites.FullControl.All, and more), achieving simultaneous full account takeover of every mobile participant. Affects both Android and iOS. Reported to MSRC, confirmed, and patched.
Research notes
- Root causeThe changeWhiteboardUrl event handler in Microsoft Teams Mobile calls loadUrl() directly without domain validation, bypassing the shouldOverrideUrlLoading hook that enforces the domain allowlist for user-initiated navigation.
- Technical detailThe nativeInterface JavaScript bridge is accessible from the whiteboard WebView and exposes authentication.getAuthToken, which returns Microsoft 365 tokens with broad delegated scopes including Mail.ReadWrite, Mail.Send, Files.ReadWrite.All, Calendars.ReadWrite, ChatMessage.Send, Sites.ReadWrite.All, EWS.AccessAsUser.All, and SharePoint Sites.FullControl.All.
- Exploit chainThe attack chain: attacker joins meeting, shares whiteboard, injects changeWhiteboardUrl pointing to attacker-controlled domain; Teams broadcasts the URL to all participants; each victim's whiteboard WebView loads the attacker's page via loadUrl(); attacker's page calls nativeInterface.framelessPostMessage with authentication.getAuthToken; exfiltrates tokens to attacker server for full account takeover of all mobile participants simultaneously.
- ExploitationThe vulnerability was reported to Microsoft Security Response Center, confirmed, and patched. The root cause affects both Android and iOS platforms.