Your OneDrive Files May Be at Risk Due to File Picker Flaw

A newly discovered flaw in Microsoft’s OneDrive File Picker poses a major security threat, affecting hundreds of applications and millions of users.

Oasis Security’s research team uncovered the vulnerability, which grants excessive access permissions to OneDrive contents during routine file uploads. The discovery has raised significant concerns over data privacy, enterprise compliance, and secure access practices in web applications.

The flaw lies in how the OneDrive File Picker functions. It requests broad read access to a user’s entire OneDrive account—even when the user selects only a single file for upload.

This issue stems from the absence of fine-grained OAuth scopes within Microsoft’s OneDrive API. As a result, developers cannot restrict apps to access only selected files.

Oasis Security warned that this vulnerability affects popular platforms such as ChatGPT, Slack, Trello, and ClickUp. Millions of users may have unknowingly granted these applications extensive access to their OneDrive data.

Microsoft is reportedly considering future updates to align File Picker permissions more precisely with actual access needs.

The problem is compounded by Microsoft’s vague user consent prompt. When users agree to share files via the File Picker, the consent language fails to clearly communicate the level of access being granted. This opens the door to both unintentional data exposure and exploitation by malicious apps.

Moreover, the latest version of OneDrive File Picker (v8.0) requires developers to manage authentication independently using the Microsoft Authentication Library (MSAL). This introduces additional security risks.

MSAL stores sensitive tokens in plain text within the browser’s session storage. The use of authorization flows may also result in the issuance of refresh tokens, enabling persistent and extended access to user data.

Also read: Microsoft Makes All New Accounts Passwordless by Default to Combat Cyber Threats

Security Recommendations from Oasis Security

Oasis Security recommends several mitigation steps for users and organizations:

For Individual Users:

1. Log into your Microsoft account and navigate to the Privacy section.
2. Under “App Access,” review all applications with OneDrive access.
3. Click “Details” for each app to review scopes and permissions.
4. Revoke access where necessary using the “Stop Sharing” option.

For Organizations:

1. Use the Entra Admin Center to view enterprise applications.
2. Identify apps by their Application ID and Object ID.
3. Open each application’s “Permissions” tab to review granted scopes.
4. Verify delegated access permissions and identify the granting user.

For Developers and Web App Providers:

1. Temporarily disable OneDrive-based file uploads if feasible.
2. Avoid requesting the “offline access” scope or using refresh tokens.
3. Remove any code that stores or utilizes refresh tokens.
4. Securely store access tokens and discard them after use.
5. Review and update all token handling logic to prevent exposure.

Users can also verify whether a website uses the OneDrive File Picker by checking permission prompts during file upload or download attempts. If OneDrive permissions appear in the prompt, the site likely integrates the File Picker.

This vulnerability highlights the critical need for precise access control and transparent consent in cloud services. Until Microsoft introduces fine-grained OAuth scopes and clearer permission dialogues, users and organizations must remain vigilant about their data-sharing practices.

About Author

Staff writer

See author's posts