Abusing Microsoft Teams rate limiting for DDoS

Omayr Zanata
Jun 10, 2020 · 6 min read
--Disclaimer--
Microsoft:
Thank you again for your submission to MSRC. Our engineers have investigated the report and we have informed the appropriate team about the issues you reported. However, this case does not meet the bar for servicing by MSRC and we will be closing this case, but the engineering team is working on improving this in the future.

Summary

The vulnerability is basically the lack of rate limit when Microsoft Teams Webhook is performing GET requests to load external images

Descritpion

Microsoft Teams Incoming Webhook supports html, so it was possible to get external images using <img src=””/>, the browser tries to load the message and the backend performs a GET request trying to retrieve the image, so it was possible to replace the picture url to any url and perform GET requests to any website, with the lack of rate limit was possible to flood the website with GET requests.

Steps to Reproduce:

IP: 52.114.128.37 
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5
whois 52.114.128.37

Supporting materials/ references:

Screenshot 1 — Testing the flood on webhook.site
Screenshot 2 — Screenshot of the Teams Screen after loading ‘images’
52.114.128.37 - - [29/Apr/2020:20:39:33 +0000] "GET /?o1o111o=961 HTTP/1.1" 200 11012 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:33 +0000] "GET /?o1o111o=350 HTTP/1.1" 200 11012 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:33 +0000] "GET /?o1o111o=990 HTTP/1.1" 200 11012 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:33 +0000] "GET /?o1o111o=341 HTTP/1.1" 200 11012 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:33 +0000] "GET /?o1o111o=950 HTTP/1.1" 200 11012 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:33 +0000] "GET /?o1o111o=910 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:33 +0000] "GET /?o1o111o=821 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:33 +0000] "GET /?o1o111o=870 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:33 +0000] "GET /?o1o111o=640 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:33 +0000] "GET /?o1o111o=451 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:33 +0000] "GET /?o1o111o=170 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:33 +0000] "GET /?o1o111o=680 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=411 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=60 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=391 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=91 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=720 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=571 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=900 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=131 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=21 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=810 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=141 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=781 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=570 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=550 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=690 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=421 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=520 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=500 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=480 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=420 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=351 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=80 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=991 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=541 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=151 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=270 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=891 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=750 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=71 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=661 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=851 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=790 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=671 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=760 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=221 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=00 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=731 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=430 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=371 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
52.114.128.37 - - [29/Apr/2020:20:39:34 +0000] "GET /?o1o111o=941 HTTP/1.1" 200 10956 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"

The Startup

Get smarter at building your thing. Join The Startup’s +791K followers.

Sign up for Top 10 Stories

By The Startup

Get smarter at building your thing. Subscribe to receive The Startup's top 10 most read stories — delivered straight into your inbox, once a week. Take a look.

By signing up, you will create a Medium account if you don’t already have one. Review our Privacy Policy for more information about our privacy practices.

Check your inbox
Medium sent you an email at to complete your subscription.

Omayr Zanata

Written by

Technical Lead @ convisoappsec.com

The Startup

Get smarter at building your thing. Follow to join The Startup’s +8 million monthly readers & +791K followers.

Omayr Zanata

Written by

Technical Lead @ convisoappsec.com

The Startup

Get smarter at building your thing. Follow to join The Startup’s +8 million monthly readers & +791K followers.

Medium is an open platform where 170 million readers come to find insightful and dynamic thinking. Here, expert and undiscovered voices alike dive into the heart of any topic and bring new ideas to the surface. Learn more

Follow the writers, publications, and topics that matter to you, and you’ll see them on your homepage and in your inbox. Explore

If you have a story to tell, knowledge to share, or a perspective to offer — welcome home. It’s easy and free to post your thinking on any topic. Write on Medium

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store