A critical security vulnerability in Microsoft’s OneDrive File Picker could potentially grant websites complete access to users’ cloud storage rather than just the specific files selected for upload. According to research by the Oasis Research Team, this vulnerability stems from excessively broad OAuth permissions and unclear consent screens that fail to properly inform users about the extent of access being granted.

The flaw affects numerous popular applications integrated with Microsoft’s cloud service, including ChatGPT, Slack, Trello, and ClickUp. The core issue lies in the OneDrive File Picker requesting read access to a user’s entire drive even when only a single file is being uploaded, due to the absence of more granular OAuth permission options.

The security risk is heightened by several factors:
– Vague consent prompts that inadequately explain the level of access being granted
– OAuth tokens stored insecurely in plaintext within browser session storage
– Potential issuance of refresh tokens that enable ongoing access without requiring re-authentication

While Microsoft has acknowledged the vulnerability, no fix has been implemented yet. Security experts recommend either temporarily disabling OneDrive file uploads through OAuth until a secure solution is available, or implementing stricter token management practices by avoiding refresh tokens and securely storing access tokens only for the duration needed.

“This discovery reinforces the importance of continuous vigilance in OAuth scope management, regular security assessments, and proactive monitoring to protect user data,” the Oasis team concluded.