[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Advisory: Insufficient Parameter Sanitization in login.live.com (Microsoft)
Web widgets hosted by Microsoft?s online login portal, login.live.com, do not perform sufficient parameter sanitization allowing an attacker to inject arbitrary text.
They are documented by Microsoft here and accept several parameters that are used to customize the resulting widget.
Example URL with malicious content:
MSRC Case # 30838 / TRK # 0189016
Microsoft Sign-in Link API: https://msdn.microsoft.com/en-us/library/bb676638.aspx
Thank you to Grier Forensics for providing advice.
This discovery qualified for a security bounty under the terms of Microsoft's Online Services Bug Bounty program.
2015-08-06: Vendor notified
2015-08-06: Initial vendor response
2015-08-11: Vendor replicated the issue
2015-08-31: Fix deployed by vendor
2015-09-17: Bounty received
2015-09-21: Public disclosure
Last updated on 2015-09-20