# MA-796.122020: MyCERT Alert - Microsoft Teams Remote Code Execution Vulnerability

**Date:** 12 Dec 2020  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-796.122020  
**Advisory ID:** MA-796.122020

---

**1.0 Introduction**
A Remote Code Execution vulnerability has been identified in Microsoft Teams (MS Teams) desktop which can be triggered by a novel Cross Site Scripting (XSS) injection in the web application (teams.microsoft.com). A specially-crafted chat message can be sent to any Microsoft Teams member or channel which will execute arbitrary code on victim devices without users interaction.
Remote Code Execution has been achieved in desktop applications across all supported platforms (Windows, macOS, Linux). Code execution gives attackers full access to victim devices and company internal networks via those devices.
Even without arbitrary code execution on victim device, with the demonstrated XSS it's possible for an attacker to obtain SSO authorisation tokens for Microsoft Teams and other Microsoft Services (e.g. Skype, Outlook, Office365). Furthermore, the XSS vulnerability by itself allows to access confidential or private conversations and files from within MS Teams.
As for the CVE part, it's currently Microsoft's policy to not issue CVEs on products that automatically updates without user's interaction.
**2.0 Impact**
A remote attacker could sends or edits an existing message that executes code when the message is viewed.
**3.0 Affected System and Devices**
- Microsoft Teams (teams.microsoft.com)
- Microsoft Teams macOS v 1.3.00.23764
- Microsoft Teams Windows v 1.3.00.21759
- Microsoft Teams Linux v 1.3.00.16851
**4.0 Recommendations**
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 - 8008 7000 (Office Hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: <https://www.mycert.org.my>
Twitter: <https://twitter.com/mycert>
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
- https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-17091
- <https://github.com/oskarsve/ms-teams-rce>
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-17091