Researchers from Positive Security have identified four (4) vulnerabilities in the popular collaboration software Microsoft Teams, as is detailed in a blog post they released on December 22nd. The flaws were first identified in March, and they are caused by exploiting the application’s “link preview” feature, in which Teams shows a preview of a sent/received link displaying general information like a thumbnail, title and a description. The flaws are classified as a server-side request forgery (SSRF) and a URL preview spoofing bug in the web/desktop versions of the application, as well as an IP address leak vulnerability and a denial-of-service (DoS) vulnerability in the Android versions of the application. To-date, only the IP address leak vulnerability affecting Android versions of the application has been patched. A Microsoft spokesperson did give context, stating that these vulnerabilities have been thoroughly researched and are not considered likely to affect many users, and that steps have already been taken to strengthen the overall security of Microsoft Teams. URL spoofing and link preview spoofing is not isolated to only affecting Teams, and the Ankura CTIX recommends that as a best practice, our readers always inspect hyperlinks before clicking on them.