Wiz Researchers Found Misconfiguration That Could Let Attackers Alter Bing Results and Steal Office 365 Tokens

Summary

Wiz researchers found a Microsoft app misconfiguration that let them alter Bing search results and demonstrate potential Office 365 token theft. Microsoft fixed the issues; testing was limited to the researchers’ own account.

Key points

A misconfigured multi-tenant Azure Active Directory app, Bing Trivia, let the researchers log in and access a CMS linked to Bing.com.
The researchers changed a Bing search result through the CMS, demonstrating that the app could control live results.
They tested a harmless XSS payload and reported that a crafted payload could steal Office 365 access tokens through Bing’s Work search feature.
A stolen token could potentially expose Outlook, Teams, SharePoint, OneDrive, and calendar data; testing was limited to the researchers’ own account.
Wiz said it responsibly disclosed the issues, and Microsoft fixed the vulnerable applications and modified some AAD functionality.
Wiz reported that approximately 25% of the multi-tenant apps it scanned lacked proper validation.

Article Details

Event Type: Wiz Research disclosed the BingBang vulnerability, an Azure Active Directory misconfiguration that enabled unauthorized access to Microsoft’s Bing Trivia application and its Bing.com content management system.
Impact: The researchers demonstrated that the CMS could be used to alter live Bing search results and that a crafted XSS payload could access Office 365 tokens. They tested token access only with their own user; no other Bing users were tested. Microsoft fixed the vulnerable applications and modified some Azure Active Directory functionality after responsible disclosure.

MITRE ATT&CK

T1059.007 · JavaScriptThe researchers demonstrated a cross-site scripting payload running through Bing.com.T1190 · Exploit Public-Facing ApplicationThe vulnerability involved exploiting a misconfigured internet-facing application to gain unauthorized access.T1528 · Steal Application Access TokenThe demonstrated XSS payload could steal Office 365 access tokens.

Vendors

MicrosoftWiz Research has identified a new attack vector in Azure Active Directory (AAD) that compromised Microsoft’s Bing.com. The attack vector is based on a common AAD misconfiguration, exposing misconfigured apps to

Products

Azure ADWiz Research has identified a new attack vector in Azure Active Directory (AAD) that compromised Microsoft’s Bing.com. The attack vector is based on a common AAD misconfiguration, exposing misconfigured apps to Bing TriviaMost surprisingly, the list included an app made by Microsoft itself, named “Bing Trivia.” Bing.comResearch has identified a new attack vector in Azure Active Directory (AAD) that compromised Microsoft’s Bing.com. The attack vector is based on a common AAD misconfiguration, exposing misconfigured apps to Microsoft OneDriveusers’ Office 365 data, including Outlook emails, calendars, Teams messages, SharePoint documents, and OneDrive files. The tests were limited to the researcher’s own user; no tests were performed on other Bing.com Microsoft SharePointattacker could access Bing users’ Office 365 data, including Outlook emails, calendars, Teams messages, SharePoint documents, and OneDrive files. The tests were limited to the researcher’s own user; no tests were Office 365allowed them to take over Bing.com functionality, modify search results, and potentially enable the Office 365 credential theft of millions of Bing users. These credentials in turn granted access to users’ private OutlookWith a stolen token, a potential attacker could access Bing users’ Office 365 data, including Outlook emails, calendars, Teams messages, SharePoint documents, and OneDrive files. The tests were limited to the Teamsa potential attacker could access Bing users’ Office 365 data, including Outlook emails, calendars, Teams messages, SharePoint documents, and OneDrive files. The tests were limited to the researcher’s own user;