A misconfigured Microsoft application allowed anyone to log in and modify Bing.com search results in real-time, as well as inject XSS attacks to potentially breach the accounts of Office 365 users.
Wiz researchers found that when creating an application in Azure App Services and Azure Functions, the app can be mistakenly configured to allow users from any Microsoft tenant, including public users, to log in to the application.
@ecksmc I’ve only used Bing when my brother was working on my pc and loaded it on there. Before that I’d been avoiding it. After that I continued avoiding it.
"According to SimilarWeb, Bing is the 27th most visited website in the world, with over a billion pageviews per month – in other words, millions of users could’ve been exposed to malicious search results and Office 365 data theft."
Most surprisingly, the list included an app made by Microsoft itself, named “Bing Trivia.”