CROSS-IDP IMPERSONATION: HIJACKING SSO TO ACCESS DOWNSTREAM APPS

Summary from the TLDR InfoSec newsletter

Cross-IdP impersonation is an attack in which an attacker signs up for an account on an app that can function as an IdP and links it to the employee's company email address via a “use existing email” option. The attacker then either bypasses verification or verifies the domain by clicking a link in the email (or socially engineering an employee to click the link). The attacker can then sign into downstream apps by using the “sign in with” option with their impersonated IdP. Application protections against this attack vary significantly so Push Security suggests that companies alert on activation links to employee's emails, warn users of the risks associated with phishing, where possible configure SaaS apps to require reauthentication to add a new IdP, and where possible prevent the conversion of a personal account to a corporate account.