EIDAPP-019: Dangling Reply URLs
- Platform
- Entra ID / M365
- Category
- Consent
- Severity
- High
- Zero Trust pillar
- Applications & Workloads (weight 2)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Reply URLs pointing to expired, unowned, or unclaimed domains enable token theft by allowing attackers to register the abandoned domain and intercept OAuth authorization codes and tokens redirected by Entra ID. This vulnerability, known as a subdomain takeover or dangling DNS attack, gives attackers the ability to obtain valid access tokens for the application's permissions without any credential compromise. All reply URLs must be validated to ensure they resolve to organization-controlled infrastructure.
Recommended value
All reply URLs resolve to active, organization-owned domains with no dangling or expired domain references
Remediation
Extract all reply URLs from application registrations and resolve each domain to verify ownership and active DNS registration. Identify any reply URLs pointing to domains that are expired, available for registration, or not controlled by the organization. Remove or update dangling reply URLs immediately and implement a periodic review process to detect new dangling references as domains expire or infrastructure changes occur.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | WARN |
| no-data | Not Assessed |
Framework mappings
- NIST SP 800-53
- CM-6
- MITRE ATT&CK
- T1566.002