Graph API Role Privilege Escalation PoC

Cloud App Admin → Global Admin via RoleManagement.ReadWrite.Directory

🚀 Quick Start Guide

  1. Get an access token with Cloud App Admin privileges
  2. Enter your access token and tenant ID
  3. Click "Run Exploit" to find vulnerable apps
  4. Use the generated cURL/PowerShell to get an SP token
  5. Enter the SP token and click "Assign Global Admin"
  6. Verify your new Global Admin status

📝 About this PoC

This PoC demonstrates how a user with Cloud App Admin privileges can escalate to Global Admin by abusing the RoleManagement.ReadWrite.Directory permission.

The exploit works by:

  1. Finding a service principal with RoleManagement.ReadWrite.Directory permission
  2. Adding new credentials to that service principal
  3. Using those credentials to assign the Global Admin role to the current user

📢 Tip: Open Dev Console (F12) for detailed logs.

🔐 Authentication

🎯 Service Principal Token Request

🛡️ Assign Global Admin Role

✅ Verify Exploit

🧹 Cleanup