AAD misconfiguration led to Bing.com results manipulation, account takeover
Wait wtf. If I understand this correctly anyone with an AD tenant (i.e. anyone) could just log in to bingtrivia.azurewebsites.net to modify the Bing page for everyone and insert JS that retrieved e-mails from logged-in visitors?! W T F<p>This seems even more ludicrous than this recent Outlook credential theft bug <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-23397" rel="nofollow">https://msrc.microsoft.com/update-guide/en-US/vulnerability/...</a> or this recent RCE glitch in the Windows networking stack <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23415" rel="nofollow">https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...</a>.<p>Can't believe this is real to be honest...