Full Report
How Wiz Research found a common misconfiguration in Azure Active Directory that compromised multiple Microsoft applications, including a Bing management portal
Analysis Summary
# Incident Report: Wide-Scale Azure AD Multi-Tenant Application Misconfiguration Exploitation
## Executive Summary
Wiz Research discovered a prevalent and critical misconfiguration vulnerability affecting multi-tenant applications deployed in Azure App Services and Azure Functions, where developers failed to implement proper OAuth token validation. This flaw allowed unauthorized access by any Azure AD user to sensitive applications. The most significant finding involved a Content Management System (CMS) powering Bing.com, which, if fully exploited, could have led to the modification of search results and high-impact Cross-Site Scripting (XSS) attacks against Bing users, potentially exposing Office 365 data. Microsoft patched all identified issues following responsible disclosure.
## Incident Details
- Discovery Date: January 31, 2023 (Earliest reported issue)
- Incident Date: Pre-January 31, 2023 (Exploitation demonstrated prior to reporting)
- Affected Organization: Microsoft (and any organization using vulnerable multi-tenant Azure services)
- Sector: Technology / Cloud Services
- Geography: Global (Applicable to any Azure tenant)
## Timeline of Events
### Initial Access
- Date/Time: Pre-January 31, 2023
- Vector: Authentication Bypass via Misconfigured Multi-Tenant Application Registration.
- Details: Attackers created an external Azure user account, obtained an OAuth token, and successfully authenticated to multi-tenant Microsoft applications (like the Bing Trivia CMS, `bingtrivia.azurewebsites.net`) because the application failed to validate the issuer, tenant ID, or specific claims within the token, relying only on token validity.
### Lateral Movement
- Details: The primary impact described involved the ability to manipulate internal-facing content (like Bing search results) via the compromised CMS, and the potential to launch XSS attacks against end-users accessing Bing, which could then be leveraged to compromise user sessions or access their O365 data (emails, documents).
### Data Exfiltration/Impact
- Impact: The core impact was unauthorized read/write access to internal application functions. Specifically demonstrated was the ability to modify Bing search results and conduct XSS attacks against Bing users, potentially leading to the compromise of user personal data stored in Outlook and SharePoint.
### Detection & Response
- Detection: January 31, 2023, by Wiz Research during internet scanning for misconfigured Azure endpoints.
- Response Actions: Wiz reported the Bing issue to MSRC on Jan 31, 2023. MSRC issued an initial fix for the Bing application the same day. Further vulnerable applications were reported on Feb 25, 2023, leading to fixes being issued by Feb 27, 2023. All reported issues were confirmed fixed by March 20, 2023.
## Attack Methodology
- Initial Access: Authentication Bypass using valid OAuth tokens from external Azure tenants targeting multi-tenant apps lacking application-level claim validation against user identity.
- Persistence: (Not explicitly detailed, but relevant if the CMS access allowed permanent configuration changes.)
- Privilege Escalation: (Not explicitly detailed, but the ability to access administrative CMS functions implies sufficient privilege within that application context.)
- Defense Evasion: Exploiting a fundamental misunderstanding of the Shared Responsibility Model concerning multi-tenant authentication validation in Azure App Services/Functions.
- Credential Access: Not the primary vector, but the XSS potential could lead to session credential theft from end-users.
- Discovery: Scanning Azure App Services and Azure Functions for publicly exposed endpoints, filtering targets based on Microsoft domains.
- Lateral Movement: Utilizing privileged access within the compromised CMS framework to alter public-facing search results.
- Collection: Potential access to sensitive user data (O365/SharePoint) through successful XSS attacks leveraging compromised Bing user sessions.
- Exfiltration: (Not explicitly detailed as demonstrated, but the potential existed via compromised user sessions).
- Impact: Modification of public search results and delivery of malicious payloads to end-users XSS.
## Impact Assessment
- Financial: Not specified, but Microsoft paid a $40,000 bug bounty.
- Data Breach: Potential exposure/theft of customer personal data, Outlook emails, and SharePoint documents through subsequent XSS attacks on affected users.
- Operational: Potential disruption to the integrity of Bing search results.
- Reputational: Significant given the vulnerability affected critical Microsoft services like Bing and exposed data integrity concerns across the Azure ecosystem.
## Indicators of Compromise
- Network Indicators: (None specified in the summary, likely related to broad scanning activity).
- File Indicators: (None specified).
- Behavioral Indicators: Successful authentication to a multi-tenant application using an OAuth token issued by a non-trusted Azure AD tenant. Suspicious modifications to records in the Bing CMS.
## Response Actions
- Containment Measures: MSRC issued immediate fixes for the specific identified vulnerable applications (e.g., the Bing application fix on Jan 31, 2023).
- Eradication Steps: Patching AAD (Azure Active Directory) functionality to reduce generalized customer exposure.
- Recovery Actions: Issuing updated customer guidance for environment owners to audit and remediate their own multi-tenant deployments.
## Lessons Learned
- Cloud Shared Responsibility Confusion: Application owners using managed services (App Services/Functions) often mistakenly believe that enabling AAD authentication secures identity validation completely, neglecting the application's responsibility to inspect OAuth claims (like tenant ID) as per best practices for multi-tenant setups.
- Prevalency of Vulnerability: Approximately 25% of scanned multi-tenant applications were found to be vulnerable, indicating this is a widespread architectural risk.
## Recommendations
- Application owners must implement strict validation checks within their application code for OAuth tokens, specifically verifying the issuer and checking relevant claims to ensure the requesting user/tenant is authorized, even if Azure handles basic token validity.
- Application owners should review their Azure App Service/Function configurations to verify tenancy settings are correctly configured (single-tenant vs. multi-tenant) and restrict tenant access explicitly when necessary.
- Utilize application logs to actively monitor for suspicious logins originating from external or unexpected tenants.