Microsoft SSPR Portal Leaks Account Verification Details

Microsoft's Self-Service Password Reset (SSPR) portal can reveal sensitive information about user accounts, making them vulnerable to attacks. Researchers from LevelBlue SpiderLabs discovered that by submitting an email address to the SSPR portal, they could determine whether the account existed and even obtain registered password-reset methods.

According to the researchers, the portal's responses provide valuable reconnaissance information, allowing attackers to confirm targets and identify likely administrator accounts. This can be done without requiring authentication, making it a concerning vulnerability.

The researchers developed a Python tool called ResetSpy to automate the process of checking lists of email addresses and analyzing the portal's responses. The tool can export results to CSV, enabling organizations to apply this technique across larger account lists.

SpiderLabs recommends that organizations monitor Entra Audit Logs for unusual SSPR activity, restrict SSPR access where necessary, and require phishing-resistant authentication for privileged accounts. They also suggest removing weaker verification methods and using Microsoft's newer anti-abuse controls.