New strict default settings are being applied in October 2021 by Microsoft due to an incident that happened back in August 2021…
‘Upguard’, a security research firm, publicised an article dated 23rd August 2021 addressing the exposure of 38 million records in Microsoft Power Apps. The article describes how an analyst found a security weakness within the Office 365 feature, as well as the responsible disclosure procedure carried out to inform Microsoft and the organisations that had their data exposed. This included databases containing sensitive information such as; US personal data and US social security numbers.
Microsoft Power Apps, described as a low code application development platform, automatically standardises data across an organisation to unlock data silos. This allows users to easily make apps that work efficiently across different departments and divisions, in order to share documents within their business. The open-source protocol which Microsoft Power Apps uses, ODATA, allows a developer to join separate databases together by using a minimal amount of code. Using the ODATA protocol enables the developer to create a table to pull data from its source, which will allow multiple selected accounts to interact with the shared documents.
The potential data exposure is a result of specific security settings not being applied, which puts the table data at risk of being accessed anonymously. Although specific instructions are available on how the protocol should be configured, it is still the developer’s responsibility to apply these settings when creating the table.
So, what now?
In response to the information received by Upguard, Microsoft have taken swift action in confirming that new versions of Microsoft Power Apps, starting in October 2021, will have strict default settings applied. Ultimately, this reduces the likelihood that user error will lead to any data exposure.
Furthermore, to provide a solution for any previous versions of Microsoft Power Apps, Microsoft have developed a set of configuration tools in order to detect potential weaknesses.
Advice and help from Microsoft, including Microsoft configuration tools, can be found here.