Google has awarded a security researcher $5,000 for discovering and reporting a cross-site scripting vulnerability in the Google Apps that could give an attacker complete control of a Google account.
Many businesses connect their domains to Google services, which allows them to access Gmail and work with Google Apps.
Blizzard Entertainment security engineer Brett Buerhaus discovered a form of XSS that could be used when logging into the management console.
The log-in process requires the user's credentials, displaying at least two Google accounts. In the Google account switching form, after selecting one of the accounts, a JavaScript is run to redirect the browser to the correct page.
“The URL used in this JavaScript is provided to the user to continue the request parameter. The request continuation parameter is a fairly common variable request in Google’s login flow. However, this is the only page I could find that did not validate the URL. The feature allows Cross-site Scripting attacks by using “javascript:” as part of the URL and will be executed upon browser redirection,” Buerhaus said in a post.
Exploiting this vulnerability could allow an attacker to create new users with any level of privileges, including super administrator, change security settings for users or domains, change domain settings, and forward incoming email messages to a different domain.
Additionally, the attacker could take control of different email accounts using the password reset method. They could disable the two-factor authentication feature, completely weakening the security on the targeted account.
The researcher published a PoC to prove his claims. Google has already fixed the vulnerability.
