CRITICAL
The severity rating of CRITICAL reflects the high likelihood of exploitation due to the broad accessibility and functionality provided by Intune. In both homelab and production environments, attackers could exploit misconfigurations or compromised credentials to gain extensive control over managed devices. Although Microsoft has published guidance on securing Intune, it is imperative that organizations promptly implement these recommendations to mitigate potential risks.

The recent cyberattack on Stryker, a medical technology firm, has raised significant concerns about the security of Microsoft Intune, an endpoint management tool used by many organizations. The attackers, associated with Iran's Handala group, leveraged vulnerabilities in Intune to wipe employees' devices and disrupt the company’s networks. This incident highlights the importance of robust access control mechanisms within endpoint management systems, as improper configurations can lead to severe consequences such as data loss and operational disruptions. To mitigate risks, it is crucial for organizations to follow best practices like enforcing least privilege principles and using role-based access controls (RBAC) effectively.

Affected Systems
  • Microsoft Intune
Affected Versions: All versions prior to the latest security update
Remediation
  • Review and enforce least privilege principles for all administrative roles by logging into the Microsoft Endpoint Manager admin center, navigating to 'Roles and Admin Assignments', and adjusting role permissions accordingly.
  • Implement Role-Based Access Controls (RBAC) in Intune to ensure that each user has only the minimum set of permissions required for their job function. This can be done through the 'Permissions' section within the Microsoft Endpoint Manager admin center.
  • Enable Conditional Access policies to restrict access to Intune based on device compliance and user sign-in locations. Navigate to Azure Active Directory > Security > Conditional Access in the Azure portal to configure these settings.
Stack Impact

The impact on homelab stacks is significant, as it may affect the configuration of Microsoft Endpoint Manager admin center and related services like Azure AD and Intune. Specific software versions impacted include any version of Intune that does not have the latest security updates applied.

Source →