Researcher breaks in to Bing, Office 365 via AAD misconfiguration, now fixed

Wiz, a cybersecurity firm discovered a major CMS that allowed me to alter search results and take over millions of …
This is the story of

— Hillai Ben-Sasson (@hillai) , Ami Luttwak, the chief technology officer at Wiz stated that “A potential attacker could have influenced Bing search results and compromised Microsoft 365 emails and data of millions of people. It could have been a nation-state trying to influence public opinion or a financially motivated hacker.”

According to Wiz:

The issues we identified in this research may affect any organization with Azure Active Directory applications that have been configured as multi-tenant but lack sufficient authorization checks. Based on data from our scans, we assess that exposure is significantly more common across Azure App Service and Azure Functions applications, where validation responsibility is unclear to developers.

The cybersecurity firm details that attackers hadn’t leveraged the vulnerability to deploy their phishing attacks to unsuspecting users. Wiz reported the issue to Microsoft’s Security Response Center on January 31. Microsoft quickly acknowledged it and issued a fix on Feb 2, a few days before mark. Had the issue not been patched in time for the launch or not discovered at all, the potential risk and threat in place would have been unimaginable. Microsoft has indicated that it is invested in putting elaborate measures to ensure that the user’s security and privacy is maintained.

It’s important for admins to ensure that multi-tenant access is properly configured. Wiz has since