Collected research

Wormable XSS www.bing.com. XSS on www.bing.com context via Maps…

Wormable XSS www.bing.com

pedbap · Medium · 22 February 2025

Bing's /maps/configurable endpoint takes a ?config= URL and loads that JSON from any host, and the config's addLayerFromURL then fetches an attacker-hosted KML file whose placemark description carries raw HTML. The KML blacklist regex that is supposed to stop this misses mixed case, so a link href of jAvAsCriPt:(confirm)(1337) survives and runs script in the www.bing.com origin - the origin other Microsoft services accept requests from.

Record

Document

Wormable XSS www.bing.com

Researcher

pedbap

Published by

Medium

Date

22 February 2025

Topic

XSS

In the archive

• Collected in the 2024 research round

Tags

• xss
• filter-bypass
• cors
• bug-bounty
• abuse-of-functionality
• owasp-a01-2021
• owasp-a03-2021
• owasp-a04-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of pedbap, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 August 2026.