Microsoft Open Redirect

Hey everyone out there ! Here i come with an open redirect vulnerability on *.Microsoft.com :-) so in short i'm going to tell you whole story how i got that shit.

The whole matter started when one of my best friend "Aakash Kumar" got acknowledged on Microsoft :O i decided i need to come up on that list too :P

I was getting mad regarding HoF of MS, Then i stated getting subdomain :D and then i got  a subdomain where i can make a tenant page on MS  and it have open redirect but i was afraid of invalid for this issue. The URL is mentioned bellow.

http://<tenant>.mms.microsoft.com/returnUrl=anydomain.com 

Then i tried the same parameter on :-

 https://weu.login.mms.microsoft.com/OrgId/SignIn.aspx

the crafted link was :

https://weu.login.mms.microsoft.com/OrgId/SignIn.aspx?ReturnHome=1&returnUrl=http%3a%2f%2fevil.com

And woah ! it got redirected and the best thing was it doesn't require any sign in or anything, direct redirection to any domain @__@

Bug timeline 

14 Feb : Bug found and reported
15 Feb : Case opened from MS
04 March : HoF + MSDN Subscription rewarded