writeups.xyz / BingBang: The AAD misconfiguration that led to Bing.com results manipulation and account takeover explained

Submitter : c2a

Date: 29 March 2023

Bounty : undisclosed

Vulnerabilities :

• Account Takeover
• Azure AD
• Cloud
• XSS
• Privilege Escalation

Programs :

• Microsoft (Bing)

Authors :

• Hillai Ben-Sasson (@Hillai)

Link :
https://www.wiz.io/blog/azure-active-directory-bing-misconfiguration