# From Recon to Bypassing MFA Implementation in OWA by Using EWS Misconfiguration

Hardcoded AD service-account creds found on GitHub; EWS endpoint lacked MFA enforcement, allowing inbox read and GAL dump despite ADFS MFA.

- Payout: unconfirmed
- Severity: high
- Program: -
- Credited: YoKo Kho
- Disclosed: 2020-06-19
- Write-up quality: 6/10
- Original: http://www.firstsight.me/2020/06/from-recon-to-bypassing-mfa-implementation-in-owa-by-using-ews-misconfiguration/
- Library page: https://bugbountylibrary.com/r/blog%3Afirstsight-me-2020-06-from-recon-to-bypassing-mfa-implementation-in-owa-by-using-ews-misconfiguration
- Tags: domain:web impact:data-leak impact:internal-access kind:bounty platform:blog sev:high tech:email technique:recon technique:source-review vuln:auth-bypass vuln:mfa-bypass vuln:misconfiguration vuln:secrets-leak

**Target:** Exchange Web Services (EWS) endpoint behind mail subdomain
**Root cause:** MFA enforced only at ADFS/OWA login, not at the EWS endpoint, so valid domain credentials authenticate to EWS without MFA enrollment.
**Steps:**
1. Recon GitHub for `.target.net` keyword; find repo with hardcoded `XYZEndpoint("username", "password")` at line 394
2. Attempt ADFS login with creds; blocked because account not enrolled in MFA
3. Enumerate subdomains (Sudomy) for .com/.net; find `mail.target.com`
4. Hit `https://mail.target.com/EWS/Exchange.asmx`; basic-auth prompt appears
5. Authenticate with leaked creds; login succeeds without MFA
6. Run `Import-Module .\MailSniper.ps1` then `Invoke-SelfSearch -Mailbox username@domain.tld -ExchHostname mail.domain.tld -Remote`
7. Read inbox; optionally dump GAL and password-spray other service accounts
**How found:** Noticed the app offered dual login (local + domain via ADFS on a different TLD), inferred domain creds grant access, then GitHub-recon'd the .net domain for hardcoded credentials; after MFA enrollment blocked ADFS, recalled Black Hills research that EWS ignores MFA and pivoted to subdomain enumeration for a mail host.
**Exploitation:** Attacker with leaked domain service-account credentials authenticates directly to the EWS endpoint, which does not enforce MFA, then uses MailSniper to search/read the mailbox and potentially dump the Global Address List for password spraying.
**Escalation:** GAL dump enables discovery of other service accounts; reuse of the same password via EWS password spraying (faster than OWA) could compromise additional accounts.
**Insight:** When an app federates to ADFS with MFA, enumerate sibling mail/webmail subdomains and test the same creds directly against `/EWS/Exchange.asmx` — MFA is often enforced only at the portal, not the EWS API.