Hacker with XSS on Google's internal network

A young hacker from the Czech Republic discovered a security loophole in one of Google's support applications.

If maliciously exploited, the error could allow hackers to steal cookies from Google employees for internal applications and seize their accounts. Extremely compelling e-fishing attempts could be launched, which would give them access to many other parts of Google's internal network.

The security loophole was discovered by researcher Thomas Orlita in February 2019. It was fixed in mid-April, but has only just been published.

Vulnerability was one (XSS), and was found on Google's billing portal, a public domain that Google redirects its business users to for submitting invoices.

Most cross-site scripting (XSS) vulnerabilities are not considered that dangerous but there are cases that can lead to very serious .

One of these cases was the discovery of Orlita. The researcher said that a malicious user could upload his own files to the Google Invoice Submission Portal, via Upload Invoice.hacker

Using a proxy the attacker could prevent the Google Invoice Submission Portal from changing the PDF document (after the submission and validation of the form) and modifying it into HTML, with malicious XSS load.

The malicious document would be stored in Google's billing backend and wait for someone to open it.

“The XSS runs on a subdomain of googleplex.com and while the worker is logged in, the attacker can access the table of the subdomain from which it is possible to view and of tariffs," Orlita told ZDNet.

"Depending on how cookies are configured on googleplex.com, it may be possible to access other internal applications hosted on this domain," the researcher added.

So since most of Google's internal applications are hosted on the googleplex.com domain, this gives attackers a lot of possibilities.

Of course, like most security vulnerabilities XSS, the risk of error depends on the hacker's skill level, and his ability to carry out more complex attacks.

For more technical details you can read Orlita publication.


iGuRu.gr The Best Technology Site in Greecefgns

Written by giorgos

George still wonders what he's doing here ...

Leave a reply

Your email address is not published. Required fields are mentioned with *

Your message will not be published if:
1. Contains insulting, defamatory, racist, offensive or inappropriate comments.
2. Causes harm to minors.
3. It interferes with the privacy and individual and social rights of other users.
4. Advertises products or services or websites.
5. Contains personal information (address, phone, etc.).