Stored XSS on Microsoft Word (Office 365)
Stored XSS vulnerability in the "Insert Video Online" feature of Microsoft Word in Office 365.
Antecedentes
Microsoft Office 365 is Microsoft's cloud-based productivity suite, which includes Word, Excel, PowerPoint, and other applications.
Description
A stored cross-site scripting vulnerability affects Microsoft Word within Office 365. The flaw allows attackers to execute arbitrary HTML or script code that persists in the victim's application. The vulnerability exists in the "Insert Online Video" functionality, where user-supplied code is not properly validated before being processed.
Business impact
Attackers could exploit this vulnerability to steal sensitive information such as user credentials and personal data by executing arbitrary code in the user's context.
Affected systems
Microsoft Office 365 (Word)
Solución
Proper escaping of untrusted data, server-side validation, auto-sanitizing libraries, and Content Security Policy are recommended.
Calendario de divulgación
References
The information contained within this advisory is supplied 'as-is' with no warranties or guarantees of fitness of use or otherwise. Internet Security Auditors accepts no responsibility for any damage caused by the use or misuse of this information.
Company based in Spain and Colombia, specializing in web application auditing, network security, penetration testing, and compliance implementation and assessment. Our clients include some of the largest finance, telecommunications, insurance, and ICT companies. A vendor-independent provider with deep experience since 2001. Our R&D efforts include vulnerability research, collaboration on open security projects, whitepapers, and participation in industry events.
Would you like us to review your product?
Contact usDo you need a security audit?
Tell us about your situation and our team will contact you to provide guidance or schedule a technical call.
Request information
Our offices
Transversal 22 # 98-82, Porta 100 Building, Office 1003
110221 Bogotá (Colombia)