Discovered by the Wiz cloud security firm and dubbed BingBang, this vulnerability allowed researchers to change the top results in Microsoft’s Bing search engine and access any user’s private files by simply logging into an unsecured web page.
The vulnerability is centered on the Microsoft Azure Active Directory and would allow any Azure user in the world to log into it without proper credentials. All it took was a misconfigured app.
In this case it was the Bing trivia app:
After recognizing these issues and their potential impact, the researchers started scanning for vulnerable applications (multi-tenant apps lacking proper validation) on the internet. The results were shocking – approximately 25% of the multi-tenant apps they scanned were vulnerable.
Most surprisingly, the list included an app made by Microsoft itself, named “Bing Trivia.”
Because this app was misconfigured, the researchers were able to log in to it with their own Azure user.
To verify that this CMS was indeed controlling Bing’s live results, they selected a keyword in the CMS and temporarily altered its content. They chose the “best soundtracks” search query, which returned a list of highly recommended movie soundtracks.
They then proceeded to change the first result, “Dune (2021),” to their personal favorite, “Hackers (1995),” and pushed it to production. Their new result, complete with their title, thumbnail, and arbitrary link, immediately appeared on Bing.com.
Researchers then found they could run Cross-Site Scripting (XSS) attacks, and since Bing and Office 365 are integrated, an attacker could access Bing users’ Office 365 data, including Outlook emails, calendars, Teams messages, SharePoint documents, and OneDrive files. The researchers reported the flaw to Microsoft and it was patched shortly afterward, resulting in a $40,000 bug bounty reward.
Brad Hong, Customer Success Lead, Horizon3.ai had this to say:
“The BingBang incident is a reminder that passwords and simple misconfigurations are still the number one attack vector for attackers. Seemingly arbitrary in nature, it can have severe consequences on an organization’s security posture. In this case, a misconfigured application made it possible for researchers to not only gain access to Microsoft’s Azure Active Directory without proper credentials, but then from a privileged perspective chain together and execute exploits on additional vulnerabilities after making their way into the castle.
“Incidents like this validate why the industry is moving away from vulnerability models and into exploitability management, as the misconception is dispelled that attackers are looking to execute zero days, but rather the easiest ways to get in. It additionally highlights the necessity to continuously attack your own infrastructure to identify as the organization’s offerings and architecture change, new or extended vulnerabilities that can be leveraged to get in. It’s also a great reminder that as the world begins to consolidate software offerings, that linkages created between them in the name of convenience and accessibility can also become its greatest downfall.”
Luckily this was caught by a team of security researchers rather than threat actors, otherwise this could have gone very, very sideways. This goes to prove that anyone can screw up and everyone needs to be on their toes when deploying code into a public facing environment.
A Simple Developer Mistake Could Have Led To Bing.com Takeover
Posted in Commentary with tags Bing on April 4, 2023 by itnerdDiscovered by the Wiz cloud security firm and dubbed BingBang, this vulnerability allowed researchers to change the top results in Microsoft’s Bing search engine and access any user’s private files by simply logging into an unsecured web page.
The vulnerability is centered on the Microsoft Azure Active Directory and would allow any Azure user in the world to log into it without proper credentials. All it took was a misconfigured app.
In this case it was the Bing trivia app:
After recognizing these issues and their potential impact, the researchers started scanning for vulnerable applications (multi-tenant apps lacking proper validation) on the internet. The results were shocking – approximately 25% of the multi-tenant apps they scanned were vulnerable.
Most surprisingly, the list included an app made by Microsoft itself, named “Bing Trivia.”
Because this app was misconfigured, the researchers were able to log in to it with their own Azure user.
To verify that this CMS was indeed controlling Bing’s live results, they selected a keyword in the CMS and temporarily altered its content. They chose the “best soundtracks” search query, which returned a list of highly recommended movie soundtracks.
They then proceeded to change the first result, “Dune (2021),” to their personal favorite, “Hackers (1995),” and pushed it to production. Their new result, complete with their title, thumbnail, and arbitrary link, immediately appeared on Bing.com.
Researchers then found they could run Cross-Site Scripting (XSS) attacks, and since Bing and Office 365 are integrated, an attacker could access Bing users’ Office 365 data, including Outlook emails, calendars, Teams messages, SharePoint documents, and OneDrive files. The researchers reported the flaw to Microsoft and it was patched shortly afterward, resulting in a $40,000 bug bounty reward.
Brad Hong, Customer Success Lead, Horizon3.ai had this to say:
“The BingBang incident is a reminder that passwords and simple misconfigurations are still the number one attack vector for attackers. Seemingly arbitrary in nature, it can have severe consequences on an organization’s security posture. In this case, a misconfigured application made it possible for researchers to not only gain access to Microsoft’s Azure Active Directory without proper credentials, but then from a privileged perspective chain together and execute exploits on additional vulnerabilities after making their way into the castle.
“Incidents like this validate why the industry is moving away from vulnerability models and into exploitability management, as the misconception is dispelled that attackers are looking to execute zero days, but rather the easiest ways to get in. It additionally highlights the necessity to continuously attack your own infrastructure to identify as the organization’s offerings and architecture change, new or extended vulnerabilities that can be leveraged to get in. It’s also a great reminder that as the world begins to consolidate software offerings, that linkages created between them in the name of convenience and accessibility can also become its greatest downfall.”
Luckily this was caught by a team of security researchers rather than threat actors, otherwise this could have gone very, very sideways. This goes to prove that anyone can screw up and everyone needs to be on their toes when deploying code into a public facing environment.
Leave a comment »