Other nomination

Wormable XSS www.bing.com. XSS on www.bing.com context via Maps…

pedbap · Medium · 22 February 2025

Bing's /maps/configurable endpoint takes a ?config= URL and loads that JSON from any host, and the config's addLayerFromURL then fetches an attacker-hosted KML file whose placemark description carries raw HTML. The KML blacklist regex that is supposed to stop this misses mixed case, so a link href of jAvAsCriPt:(confirm)(1337) survives and runs script in the www.bing.com origin - the origin other Microsoft services accept requests from.

Record

Researcher

pedbap

Published by

Medium

Date

22 February 2025

In the archive

• Nominated for the 2024 Top 10 Web Hacking Techniques

Tags

• xss
• filter-bypass
• cors
• bug-bounty
• abuse-of-functionality
• owasp-a01-2021
• owasp-a03-2021
• owasp-a04-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of pedbap, first published at the original source. Preserved copies are kept so the citation survives its host.