برطرف کردن آسیبپذیری جدید Azure AD و تأثیرگذار بر موتور جستجوی Bing و دیگر برنامههای اصلی توسط مایکروسافت
?????????? ?? ???? ???????? ?????? ?? ????? ???? ??? ?? ?? ????? ?????? ?????? ? ???? Azure Active Directory (AAD) ????? ???????? [?] ?? ????? ?????? «?? ????? ????» (?? ???? ????? ?????? Bing) ?? ?? ???? ?????? ??????? ???? ???? ???.
???? ????? ???? Wiz ?? ?????? ?????????? ???[?]: «??? ?? ??? ????????? ?? ????? ?????? ????? (CMS) ??? ?? ?? Bing.com ???? ?????? ? ?? ?? ????? ?????? ?? ??????? ????? ????? ?? ?????? ????? ???? ????? XSS ????? ?? ?? ??????? Bing ????? ????. ??? ????? ????????? ??????? ???? ??????? ?????? ????????? Outlook ? ????? ???????? ?? ?? ??? ????????.»
??? ?????? ?? ?????? ? ????? ???? ?? ?????????? ????? ??? ??????? ??? ??? ?????? ??????? ?? ????? ??? ? ?????? ???? ????? ??? ??? ?? Wiz ???? ???. ?????????? ???[?] ?? ??? ????? ???? ?? ??????????? ?? ??? ???????????? ?????? ?? ??? ??????? ???? ????? ???.
???? ??? ?????????? ???? ?? ???? ??? ?? Shared Responsibility confusion ?????? ??????? ?? ?? ?? ?? ?????? Azure ???????? ????????? ???????? ??? ?? ?? ??????? ?? ?????? ?????????? ????? ??? ?? ???? ?? ?? ???? ?????? ?????? ???????? ???.
???? ??????? ?? ?????? ?? ?????????? ????? ??? ?????????? ??? ????? ?? ???? ??????? ? ??????? ?? ??????? ????? ????? ??????? ?? ?????? ? ????? ???? ?????????? ??? ????? ?? ?????? ????.
??? ???? ?????? Bing Trivia ??? ?? ??? ???? ????? ?????? ?? ?? ???? ????? ????? ????? ?? Bing ? ??? ???????? ?????? ???? ???? ???????? ???? ?? ?????? ???? ?? ??? BingBang ??????? ???.
???? ?? ??? ??? ???????? ???????? ???? ?????????? ?? ???? ??????? ??? ????? (XSS) ?? Bing.com ? ??????? ????????? Outlook? ????????? ???????? Teams? ????? ???????? ? ???????? OneDrive ?????? ??????? ???.
Hillai Ben-Sasson? ???? Wiz? ???????? ???: «?? ???? ???? ?? ?????? ????? ????????? ?????????? ????? ????? ?? ?? payload ????? hijack ??? ? ???????? ???? ????????? ????? ?? ???? ???».
???? ??????????? ?? ?? ???? ??? ???? ???????? ?????? ????? ????????? ?? Mag News? Central Notification Service (CNS)? ???? ????? PoliCheck? Power Automate Blog ? COSMOS.
??? ????? ????? ????? ?????? ?? ???? ??? ???? ??????? NetSPI ?????? ?????????? ?????? ?????? ?? ?? ?????????? [?]Power Platform ??? ???[?] ?? ??????? ?? ?? ???? ?????? ?? ???????? ???? ?????????? ???.
?? ?? ????? ???????? ?? ??????? ????? ?????????? deserialization ???? ?????????? ?? ?????? ???? ????? ??.
??? ????? ?????? ?? ????? ?????? ????????? ???? ????? Super FabriXss (CVE-2023-23383? ?????? CVSS: 8.2)? ?? ??????????[?] XSS ????????? ?? Azure Service Fabric Explorer (SFX) ??? ?? ???????? ???? ?? ????? ?? ?? ??? ??? ???? ????? ???? ???.
?????
[?] https://azure.microsoft.com/en-us/products/active-directory
[?] https://www.wiz.io/blog/azure-active-directory-bing-misconfiguration
[?] https://msrc.microsoft.com/blog/2023/03/guidance-on-potential-misconfiguration-of-authorization-of-multi-tenant-applications-that-use-azure-ad
[?] https://learn.microsoft.com/en-us/connectors/connectors
[?] https://www.netspi.com/blog/technical/vulnerability-research/azure-service-bus-power-platform/
[?] https://thehackernews.com/2023/03/researchers-detail-severe-super.html
[?] https://thehackernews.com/2023/04/microsoft-fixes-new-azure-ad.html
