Data Leakage Vulnerability Discovered in Microsoft Power BI Service

The Nokod Research Team has identified a significant data leakage vulnerability in Microsoft’s Power BI service, potentially affecting tens of thousands of organizations globally.

This vulnerability allows unauthorized access to sensitive data, including employee, customer, business, government data, Protected Health Information (PHI), and Personally Identifiable Information (PII), through the Internet.

Easy-to-Exploit Vulnerability

The discovered vulnerability is notably easy to exploit, enabling attackers to extract information not visible in Power BI reports but present in the underlying data model. Potential data leakage scenarios include access to:

• Detailed and confidential data behind aggregated or anonymized data
• Additional attributes and data assets not included in the displayed report
• Data records filtered out from the display

Technical Analysis

Description of the Issue

Power BI reports are built on a semantic model representing all data available for visualization. When a report is shared, all underlying raw data in the semantic model becomes accessible, including:

• Detailed data records used for aggregations in the report’s UI
• Tables included in the semantic model but not displayed in the report
• Non-displayed columns of tables, even if marked as “hidden”
• Detailed data records filtered out from the display

This behavior affects both internal and publicly accessible reports.

Exploit Details

Executing a Power BI report involves an API call to extract the data to be displayed. For public reports, the endpoint is:

https://wabi-west-europe-f-primary-api.analysis.windows.net/public/reports/querydata

For internal reports, the endpoint is:

https://pbipweu14-westeurope.pbidedicated.windows.net/webapi/capacities/<capacityObjectId>/workloads/QES/QueryExecutionService/automatic/public/query

The payload is a JSON message representing a query in Power BI format. The response includes a JSON representation of the requested data. Attackers can easily remove filters and aggregations or add hidden data with some knowledge of the data schema.

Exposure in the Wild

The vulnerability affects almost any organization sharing Power BI reports internally, with a critical concern for those publishing reports on the web.

Tens of thousands of reports are publicly available, sharing corporate, product, financial, healthcare, government, and other information.

Simple search strings can yield countless results, exposing sensitive data.

Remediation

Microsoft considers the behavior a design choice, placing the responsibility on organizations to avoid disclosing sensitive information. Nokod disagrees with this assessment and offers the following guidelines:

• Remove “hidden” tables and columns from the semantic model.
• Use Power Query expressions to restrict the “Data Source” attached to the “Semantic Model.”
• Select non-sensitive columns for aggregated data or use Power Query expressions for aggregation.

Organizations should frequently review their Power BI environments for unintentionally published or overshared reports and ensure their semantic models follow these guidelines.

Microsoft’s Response

Nokod reported the findings to the Microsoft Security Response Center (MSRC) on May 16, 2024. Microsoft confirmed the issue on May 18, 2024, but classified it as a feature rather than a vulnerability.

In response, Nokod Security has developed the “Power BI Analyzer,” a free tool to help organizations assess their exposure to this vulnerability. The tool is available for download on Nokod’s website.

Also Read:

• Hackers Weaponize Windows Shortcut Files to Attack Government Organizations
• JetBrains Warns of GitHub plugin that Exposes access tokens to third-party site