A security flaw in Bing Images allowed malicious SVG files to execute commands on Microsoft's production image-processing servers with elevated privileges. This vulnerability was discovered by a tester known as XBOW. The issue affected both Windows and Linux machines.
The flaw enabled a crafted SVG image submitted to Bing's image search to run commands as NT AUTHORITY\SYSTEM on Microsoft's Windows servers. On Linux machines in the same fleet, the commands were executed as root.
XBOW's testing revealed that the vulnerability was not limited to a specific host or network range, as the same results were obtained across different environments. This suggests a widespread issue within Microsoft's infrastructure.
The severity of the vulnerability lies in its ability to allow an attacker to execute arbitrary commands on Microsoft's servers. This could potentially be used to steal sensitive information, disrupt service, or install malware.
The discovery highlights the risks associated with image processing and the potential for malicious files to be used as a vector for attack. It also underscores the importance of robust security measures in image processing pipelines.
The consequences of such a vulnerability are significant, as it could be used to compromise Microsoft's servers and potentially gain access to sensitive information. Microsoft would need to patch the vulnerability and ensure that their image processing infrastructure is secure to prevent such attacks.
What was the vulnerability in Bing Images? The flaw allowed crafted SVG images to execute commands on Microsoft's servers with elevated privileges. It affected both Windows and Linux machines.
How was the vulnerability discovered? The issue was discovered by a security tester known as XBOW, who submitted a crafted SVG image to Bing's image search and observed the execution of commands on Microsoft's servers.
What are the potential consequences of this vulnerability? The vulnerability could be used to steal sensitive information, disrupt service, or install malware on Microsoft's servers, highlighting the need for robust security measures in image processing.