OneDrive File Picker is a Microsoft-provided tool that allows websites and web applications to integrate with users’ OneDrive accounts to allow uploading, browsing, and selecting OneDrive files directly from the app.
An overprivileged Oauth trap
This extensive access stems from the limitations of Microsoft’s OAuth implementation in file selectors, which researchers call “lack of fine-grained permission scopes.”
Jason Soroko, a senior researcher at Sectigo, called oversight the Oauth Trap an overprivileged one. “Microsoft’s OneDrive file selector encourages third-party web applications to request a wide range of files,” he said. “Once released, these long-lived tokens are often cached locally or in backend databases without encryption, potentially allowing attackers to drag data from the entire tenant.”
OneDrive File Picker’s OAuth implementation requests a wide range of requests, rather than a fine-grained file-level range, allowing users and developers to restrict access to explicitly selected files only.
