AAD misconfiguration led to Bing.com results manipulation, account takeover
Wait wtf. If I understand this correctly anyone with an AD tenant (i.e. anyone) could just log in to bingtrivia.azurewebsites.net to modify the Bing page for everyone and insert JS that retrieved e-mails from logged-in visitors?! W T FThis seems even more ludicrous than this recent Outlook credential theft bug https://msrc.microsoft.com/update-guide/en-US/vulnerability/... or this recent RCE glitch in the Windows networking stack https://msrc.microsoft.com/update-guide/vulnerability/CVE-20....Can't believe this is real to be honest...