Security Flaw in Microsoft OneDrive File Picker Exposes Users to Potential Data Breaches
May 28, 2025
Recent findings from cybersecurity researchers at the Oasis Research Team have unveiled a serious vulnerability within Microsoft’s OneDrive File Picker. This flaw enables websites to gain unrestricted access to users’ entire cloud storage, even when only a single file is intended for upload. The report, shared with The Hacker News, emphasizes that the issue arises from excessively broad OAuth permissions and ambiguous consent screens, which do not adequately inform users about the true scope of access being granted to applications.
The ramifications of this vulnerability are significant and could potentially lead to considerable data leakage, as well as violations of compliance regulations that many organizations are bound to uphold. Notably, several widely used applications, including ChatGPT, Slack, Trello, and ClickUp, could be at risk due to their integration with Microsoft’s cloud services. This broad risk underscores the necessity for business owners to remain vigilant regarding third-party application permissions that access cloud storage solutions.
The core of the problem lies in the OneDrive File Picker’s design, which requests grants for read access to the entire drive. This request persists regardless of whether users upload just one file, indicating a lack of fine-grained access control. Given the increasing reliance on cloud storage for sensitive business data, such inherent flaws pose a considerable threat not only to user privacy but also to organizational security frameworks.
From a threat landscape perspective, this incident can be analyzed through the lens of the MITRE ATT&CK Matrix, which serves as a comprehensive guide for understanding adversary tactics and techniques. The initial access technique could be correlated with the exploitation of this vulnerability, as unauthorized applications could gain access to sensitive data. Additionally, tactics related to privilege escalation may be leveraged if attackers aim to enhance their access rights beyond what is normally permitted.
Organizations must take immediate action to assess their integrations with any applications utilizing the OneDrive File Picker. Understanding the implications of granting extensive permissions should be a priority for business leaders, particularly in sectors that handle sensitive or regulated information.
As cybersecurity threats continue to evolve, keeping abreast of such vulnerabilities is critical for safeguarding organizational assets and maintaining compliance with data protection regulations. The findings regarding the OneDrive File Picker serve as a vital reminder of the importance of rigorous security assessments and the need for clearer communication around the permissions that web applications request when accessing cloud storage environments.
