Privacy nightmare: Microsoft OneDrive gives AI chatbot full read access to user content

Users discover that letting an AI chatbot or other app access a single file on OneDrive also grants it access to their entire OneDrive content.

A massive vulnerability in the implementation of Microsoft's OneDrive File Picker exposes the entire user’s OneDrive content, the Oasis Security cyber research team uncovered.

File picker is a Microsoft-provided tool for web or mobile apps to select user files directly from their OneDrive cloud storage when they want to upload or share them.

However, according to the report, if the user uses the tool once to upload a single file to a third-party service, such as ChatGPT, Slack, Trello, or ClickUp, these tools gain access to all the files.

Researchers estimate that hundreds of apps are affected and maintain this access for extended periods.

“Millions of users may have already granted these apps access to their OneDrive. This flaw could have severe consequences, including customer data leakage and violation of compliance regulations,” Oasis warns.

OneDrive uses OAuth, an industry-standard protocol that allows services to securely access private user data without requiring a separate login.

However, OneDrive implementation doesn’t have a fine-grained scope – File Picker requests read access to the entire drive when accessing just a single file.

“While users are prompted to provide consent before completing an upload, the prompt’s vague and unclear language does not communicate the level of access being granted, leaving users open to unexpected security risks,” the report reads.

The flaw, combined with Microsoft’s “vague user prompt,” also makes it impossible for users to “distinguish between malicious apps that target all files and legitimate apps that ask for excessive permissions.” Both personal and enterprise users are at risk.

Oasis disclosed the flaw to Microsoft and other vendors before publishing the report.

“In response, Microsoft is considering future improvements, including more precise alignment between what OneDrive File Picker does and the access it requires,” the team said.

Microsoft confirmed the issue to Cybernews.

“We appreciate the partnership with Oasis Security in responsibly disclosing this issue. This technique does not meet our bar for immediate servicing, as a user must provide consent to the application before any access is allowed. We will consider improvements to the experience in a future release,” said a Microsoft spokesperson.

The researchers also said that Microsoft Authentication Library (MSAL), which enables apps to sign in users and access Microsoft services, stores sensitive tokens in plain text in the browser’s session storage.

Oasis Security recommends individuals and admins review the third-party access they’ve granted to the account to mitigate the potential risks.

The researchers also urge web app developers to temporarily remove the option to upload files using OneDrive through OAuth until Microsoft provides a secure alternative.

Updated on May 30th [06:30 a.m. GMT] with a statement from Microsoft.