Microsoft Teams: Always Available

The injected function reads the user's Microsoft Teams OAuth bearer token directly out of teams.microsoft.com localStorage (key 'ts.<oid>.cache.token.https://presence.teams.microsoft.com/'). Harvesting an authenticated session token from another origin's storage is a credential-access pattern; even though this build only sends the token back to Microsoft, the same code path could trivially be modified (or already abused via a server-pushed update) to exfiltrate the bearer token elsewhere.

try {  const latestOid = localStorage['ts.latestOid'];  const tokenJSON = localStorage['ts.' + latestOid +    '.cache.token.https://presence.teams.microsoft.com/'];  const token = JSON.parse(tokenJSON)    .token;  const response = await fetch('https://presence.teams.microsoft.com/v1/me/forceavailability/', {    'headers': {      'Content-Type': 'application/json',      'Authorization': `Bearer ${token}`    },    'body': `{"availability":"${statusType}"}`,    'method': 'PUT'  });

A 30-second alarm continuously injects a function into any open teams.microsoft.com tab via chrome.scripting.executeScript. The injected code runs in the page's MAIN world context and uses the user's session to issue authenticated PUT requests to the Teams presence API, automating account behavior to deceive Microsoft's presence system about whether the user is at their computer. This is privilege escalation / unauthorized automation against a third-party service using the user's credentials.

chrome.runtime.onInstalled.addListener(async () => {  chrome.alarms.create('forceTeamsAvailability', {    periodInMinutes: .5  });});chrome.alarms.onAlarm.addListener(alarm => {  if (alarm.name === 'forceTeamsAvailability') {    runForceAvailability();  }});const runForceAvailability = async function() {  chrome.tabs.query({    'url': 'https://teams.microsoft.com/*'  }, function(items) {    for (tab of items) {      console.log("tab found: " + tab.url);      chrome.scripting.executeScript({          target: {            tabId: tab.id          },          function: requestForceAvailability        },        () => {}      );      break;    }  });}

statusType is read from chrome.storage.sync and concatenated unsanitized into a JSON body string. A malicious or corrupted sync value containing a quote could break out of the JSON string and inject arbitrary fields into the body sent to Microsoft's API. Low-impact in this code path (host is restricted to teams.microsoft.com), but it is a JSON injection sink against a privileged authenticated endpoint.

const response = await fetch('https://presence.teams.microsoft.com/v1/me/forceavailability/', {  'headers': {    'Content-Type': 'application/json',    'Authorization': `Bearer ${token}`  },  'body': `{"availability":"${statusType}"}`,  'method': 'PUT'});