Search This Blog

Juan Sacco (runlvl) exposed XSS vulnerability in Bing.com Maps

Juan Sacco (runlvl),One of the Security Researcher - Insecurity Research Labs exposed the XSS vulnerability in Bing.com Search Engine.

BING.COM is prone to a XSS vulnerability because the application fails
to properly perform adequate boundary checks on user-supplied data.
An attacker can exploit this issue to execute arbitrary code in the
victim's browser.

Details
The reflected XSS vulnerability is a variant of a cross-site scripting
flaw: it occurs when the data provided by the attacker is exectued by
the browser, and then displayed on "normal" pages returned to other
users in the course of regular browsing, without proper HTML escaping. A
classic example of this is with online message boards where users are
allowed to post HTML formatted messages for other users to read

Vulnerabilit Details:
  • Name : XSS Reflected on BING.COM
  • Vulnerability Type : XSS Reflected
  • Severity : Very High
  • Researcher : Juan Sacco (runlvl) 
  • Vulnerable Link: here

The vulnerability is caused by the following code and affected by the
Generate Code map

<div id="LME_mapLinks" style="line-height: 20px">
<a id="LME_largerMap" //--&gt;&quot;&gt;'&gt; on Bing Maps (New
window)">View Larger Map</a>
</div>




Credits
Manual discovered by Insecurity Research Labs
Juan Sacco (runlvl) - http://www.insecurityresearch.com
Share it:

Bing Hacks

Hackers News

Microsoft Hacks

Security News

Vulnerability

Web Application Vulnerability

XSS Injection