Serious flaw in Bing and Office allowed searches to be modified and data stolen

Wiz’s digital security researchers discovered a serious vulnerability in Microsoft services such as Bing and Office 365. If used criminally, this vulnerability could lead to user data exposure and modification of content on official company services.

According to the group’s report, a breach in the Azure cloud services platform led scientists to change search results related to Search engine bin. In addition, the vulnerability allowed access to private data of those who have an Outlook account, subscribe to the Office 65 suite, and use services such as Microsoft Teams.

How did the leak work?

Wiz was able to access a Microsoft command center while logging into the quiz app with an Azure account bing trivia. However, the account was given additional administrator privileges and could access and even modify the tables that appeared on the search results page.

He placed the film as part of the test. “Hackers – Hackers”, on a list that should include only soundtrack award-winning productions from 1995. It replaced the production of “Dune” from 2021.

In addition, the researchers noticed that it was possible to include content such as links or downloads that redirect users to malicious sites in these results. In another test, the same account obtained access to valid Office 365 user tokens by extracting messages, calendar details, and even documents from an account that was created just to be the target.

Fixed crash

After discovering and testing without compromising third-party information, the team reported the error to Microsoft in January 2023. Soon, security bug fixed by the company through an update to the platform codes.

According to the company, no illegal use security vulnerability detected.