A Microsoft misconfiguration error created an opening for attackers to not only manipulate Bing search results, but to potentially steal Office 365 credentials.
The good news is that the issue was discovered by a major cloud security firm, duly reported to Microsoft, and patched. The bad news is that the configuration issue is easy to accidentally replicate in Azure Active Directory multi-tenant apps, and the researchers found that about 25% of those that they scanned were vulnerable.
Bing search results open to manipulation due to configuration mistake
The issue was discovered by researchers with Wiz, who gave it the name “BingBang” due to the shocking finding that Bing search results and other Microsoft products were open to attackers.
The problem originates with Azure Active Directory (AAD), and is not so much a code flaw as it is an element that is not well-documented and that developers frequently miss. AAD can be configured for different types of account access, including a “multi-tenant” option that allows logins by any user from any Azure tenant. When this option is implemented, it is incumbent upon the app developer to check and validate the access status of each user, otherwise anyone with an Azure account could log in to the app.
What the Wiz researchers discovered is that this architecture tends to not be well understood by developers. A series of scans for apps that are vulnerable in this way turned up a rate of about 25% of those using multi-tenant account access. One name that stood out in this scan was “Bing Trivia,” which belonged to Microsoft itself. The researchers were able to use their own Azure credentials to log in, at which point they discovered a content management system (CMS) that provided privileged access to Bing.com.
The researchers quickly found they were able to manipulate Bing search results by selecting a keyword or search query phrase, and altering the rankings of top entries that are returned to the user. This created an obvious hazard of a threat actor replacing these priority search results with some sort of malicious links or misinformation.
The problem goes beyond Bing search results, however. The researchers also noted that it would be possible to leverage this access into a cross-site scripting (XSS) attack that would steal the Office 365 credentials of users that were logged in while accessing Bing. This could be done by adding a simple XSS payload directly to the main Bing.com page, snatching up the authentication token that allows Bing and Office 365 to integrate with each other in user accounts. The attacker would have immediate access to user Office 365 data such as email, OneDrive and SharePoint files, Teams messages and calendars.
Microsoft fixed the issues with its own internal apps prior to the publication of the vulnerability, cutting off this avenue of access to Bing search results and Office 365, and also made some changes to AAD to help steer developers away from the configuration mistake. AAD now no longer issues access tokens to clients that are not registered in resource tenants, and has added new checks for Azure App Service Authentication that match users to allow lists. The researchers received a bug bounty of $40,000 for their efforts.
Unclear if threat actors found their way to serious Azure vulnerability first
The Wiz researchers first reported the Bing search results vulnerability to Microsoft on January 31 of this year, and the company confirmed the fixes on March 28. But it remains unclear how long this attack was possible prior to that, or to what extent other people may have discovered it. Bing was hacked by Lapsus$ in March 2022, but that incident involved the theft (and leaking) of source code repositories and has not been connected to this present vulnerability. Some security researchers believe that Lapsus$ may have paid an insider for access in that 2022 incident, something that the group has been known to do in other attacks.
The incident comes as Bing is enjoying a surge in search business, after spending its life playing a distant second fiddle to Google. The new business is coming from a mix of Bing search results now incorporating an AI component, and general dissatisfaction with Google results that are sometimes perceived as prioritizing advertisements and Google’s own products (such as YouTube videos) too much. Various web traffic measurement services now put Bing at the 27th to 30th most visited website in the world.
The Bing search results breach adds to a string of Azure-related security issues that now stretches back several years. The most serious of the recent incidents was the “BlueBleed” breach of October 2022 that was created by a misconfigured Azure endpoint and ended up exposing the data of some 150,000 companies across the world.
Brad Hong, Customer Success Lead for Horizon3.ai, notes that attackers will never stop looking for the simplest ways to breach systems: “The BingBang incident is a reminder that passwords and simple misconfigurations are still the number one attack vector for attackers. Seemingly arbitrary in nature, it can have severe consequences on an organization’s security posture. In this case, a misconfigured application made it possible for researchers to not only gain access to Microsoft’s Azure Active Directory without proper credentials, but then from a privileged perspective chain together and execute exploits on additional vulnerabilities after making their way into the castle. Incidents like this validate why the industry is moving away from vulnerability models and into exploitability management, as the misconception is dispelled that attackers are looking to execute zero days, but rather the easiest ways to get in. It additionally highlights the necessity to continuously attack your own infrastructure to identify as the organization’s offerings and architecture change, new or extended vulnerabilities that can be leveraged to get in.”
“It’s also a great reminder that as the world begins to consolidate software offerings, that linkages created between them in the name of convenience and accessibility can also become its greatest downfall,” added Hong.
