Search papers, labs, and topics across Lattice.
This paper investigates vulnerabilities in cross-tenant notification workflows within cloud applications, where authenticated actors can manipulate messages sent through trusted provider services. The authors identify three distinct attack vectors that exploit weaknesses in application-layer authorization, allowing attackers to send unauthorized content to recipients across tenant boundaries. Their findings reveal that conventional email authentication methods like SPF, DKIM, and DMARC are insufficient to prevent these types of abuses, necessitating improved controls for tenant binding and authorization validation.
Authenticated actors can exploit cloud notification systems to send unauthorized messages, bypassing traditional email security measures.
Cloud applications routinely send notifications through provider-operated mail identities, which improves deliverability but separates the actor who supplies notification parameters from the service principal that originates the message. In three responsibly disclosed and remediated cross-tenant notification workflows, an authenticated actor could reach recipients across tenant boundaries and, to varying degrees, control content that a trusted provider service delivered. In the first, backend requests bypassed a UI length limit, raw HTML and CSS survived into the delivered message, attacker links rendered, and CSS could hide service-controlled text; iframes and non-web URI schemes were rejected. The second combined missing recipient-tenant validation with attacker-controlled subject and HTML fields. The third, an approval application, added weak access control, sequential object identifiers, missing action authorization, and incomplete token validation, composing notification abuse with authorization failures. The pattern is analogous to a classical unauthenticated SMTP open relay, but the failure has moved up the stack: the actor is authenticated and the provider is the legitimate sender, yet application-layer authorization still fails to constrain who may cause it to send what to whom. We define a trusted workflow relay as a delivered, service-authentic message for which the application-level send-authorization predicate is false. We give a test matrix for notification pipelines, map the primitive to MITRE ATT&CK techniques for attachment-free phishing, and link it to device-code phishing (RFC 8628). SPF, DKIM, and DMARC can authenticate a message yet cannot establish that an application-level send was authorized. We conclude with controls for tenant binding, typed templates, object-level authorization, token audience validation, and identity telemetry.
