# BingBang: How a simple developer mistake could have led to Bing.com takeover

Misconfigured multi-tenant Azure AD app 'Bing Trivia' lacked tenant validation, letting any Azure user reach a Bing.com CMS and alter search results.

- Payout: Research
- Severity: critical
- Program: Microsoft Bing
- Write-up by: Wiz Research
- Disclosed: 2023-03-29
- Write-up quality: 8/10
- Original: https://www.wiz.io/blog/bingbang
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-bingbang
- Tags: area:cloud domain:cloud impact:ato impact:data-leak kind:research platform:threat-intel sev:critical tech:azure tech:oauth technique:chained technique:recon vuln:access-control vuln:auth-bypass vuln:xss

**Target:** Multi-tenant Azure AD app (Bing Trivia) linked to Bing.com CMS
**Root cause:** Multi-tenant AAD app did not validate the user's original tenant, so any Azure user worldwide could authenticate; the app was linked to a Bing.com CMS.
**Steps:**
1. Scan internet for multi-tenant AAD apps lacking tenant validation (~25% vulnerable).
2. Identify Microsoft's 'Bing Trivia' app as misconfigured.
3. Log in to Bing Trivia with researcher's own Azure user account.
4. Reach a CMS linked to Bing.com from within the app.
5. Edit 'best soundtracks' query, change first result 'Dune (2021)' to 'Hackers (1995)' with custom title/thumbnail/link, push to production.
6. Confirm altered result appears live on Bing.com.
7. Add harmless XSS payload to Bing.com, confirm execution, revert and report.
8. Craft XSS payload stealing Office 365 access tokens via Bing's 'Work' integration.
**How found:** Researchers investigating novel cloud attack vectors in AAD noticed the shared-responsibility gap in multi-tenant apps; after recognizing the pattern they scanned the internet for multi-tenant apps lacking tenant validation, finding ~25% vulnerable including Microsoft's own Bing Trivia.
**Exploitation:** Any Azure user could authenticate to the misconfigured Bing Trivia app and reach the Bing.com CMS, allowing arbitrary modification of live search results (misinformation, phishing, impersonation). Injected XSS on Bing.com could exfiltrate Office 365 access tokens of logged-in Bing users, granting access to Outlook, Teams, SharePoint, OneDrive. Tests limited to researcher's own account.
**Escalation:** Chained AAD misconfiguration to CMS access, then to stored XSS on Bing.com, then to Office 365 token theft affecting millions of users.
**Insight:** Enumerate multi-tenant AAD/OIDC apps and test whether they enforce tenant (tid) validation after login; a misconfigured consumer-facing app can bridge into internal CMS/admin surfaces of the same org.