Wiz Researchers Show How Azure AD Misconfiguration Enabled Bing Content Changes and XSS
Summary
Wiz researchers found that poorly validated multi-tenant Azure AD apps exposed Microsoft applications, including Bing Trivia. They demonstrated search-result manipulation and an XSS attack that accessed Office 365 data from their test account.
Key points
- The researchers said about 25% of the multi-tenant applications they scanned were vulnerable to authentication bypass because applications did not properly validate users’ identities and access.
- Using an account from another Azure tenant, they accessed Bing Trivia and changed content that appeared in Bing search results.
- They demonstrated XSS and used it to obtain an Office 365 token from their test account, then access that account’s emails and other data.
- Wiz also reported similar exposure in other Microsoft applications, including tools for newsletters, notifications, customer support, and file management.
- The researchers reported the issues to Microsoft; Microsoft said the affected applications were fixed by March 20, 2023, and updated Azure AD guidance and functionality.
- For remediation, the article recommends disabling multi-tenancy when unnecessary or enforcing access through user assignment, conditional access, or claims-based authorization checks.
Article Details
- Attack Vectors
- Misconfigured multi-tenant Azure Active Directory applications accepted sign-ins from users in other tenants without sufficient authorization or token-claim validation.
- Researchers used an account from their own Azure tenant to access the Bing Trivia CMS, then changed content that appeared in Bing search results.
- The researchers tested an XSS payload through the CMS; they reported that it could retrieve an Office 365 token and access data associated with the user. The article says a malicious actor could have used this method against Bing users.
- Other exposed Microsoft applications included panels or APIs that could send arbitrary emails, read or send internal notifications, control call-center agents, edit blog posts, and access internal files.
- Defensive Notes
- Use single-tenant authentication when external tenancy is not required.
- For required external access, consider user assignment or conditional access policies, and implement claims-based authorization and token checks in application code.
- Review Azure AD service principals and application registrations for multi-tenant access; test whether a user from a different tenant can sign in when that access is not intended.
- Because Azure Active Directory logs may not show past activity sufficiently, review application logs for suspicious sign-ins.
- The article reports that Microsoft fixed the applications reported by Wiz Research and updated customer guidance.
MITRE ATT&CK
T1078.004 · Cloud AccountsWiz researchers used a newly created account in their own Azure tenant to sign in to the misconfigured multi-tenant Bing Trivia application.T1189 · Drive-by CompromiseThe article describes the potential for XSS placed through the Bing content-management system to affect users viewing Bing content.T1190 · Exploit Public-Facing ApplicationThe researchers accessed externally exposed Microsoft applications through an authentication bypass caused by insufficient authorization checks.T1528 · Steal Application Access TokenThe researchers demonstrated that an XSS payload could obtain an Office 365 token and use it to access the research account’s data.T1565.001 · Stored Data ManipulationThe researchers changed Bing Trivia CMS content, and the edited search result appeared on Bing.com.T1659 · Content InjectionThe researchers used the exposed CMS to alter content displayed on Bing, and tested an XSS payload; the article says a malicious actor could use the access to inject malicious content.
People
Hillai Ben-SassonNamed as a member of the Wiz Research team that reported the findings.Nir OhfeldNamed as a member of the Wiz Research team that reported the findings.Ronen ShustinNamed as a member of the Wiz Research team that reported the findings.Sagi TzadikNamed as a member of the Wiz Research team that reported the findings.Shir TamariNamed as a member of the Wiz Research team that reported the findings.
Vendors
Products
Azure App ServicesThese misconfigurations are fairly popular, especially with Azure App Services and Azure Functions.Azure FunctionsThese misconfigurations are fairly popular, especially with Azure App Services and Azure Functions.BingOne of these apps is a content management system (CMS) that powers Bing.com and allowed us to not only modify search results, but also launch high-impact XSS attacks on Bing users.Office 365search results on Bing.com and perform XSS attacks on Bing users, potentially exposing customers’ Office 365 data such as emails, chats, and documents. This blog will also provide details about the