2017-019: Stored XSS found in Google Earth

Original release date: 23, 11 2017
Last revised: Nov 23, 2017
Severity: 6.4 CVSSv2/(AV:N/AC:L/Au:N/C:P/I:P/A:N)

BACKGROUND

Google Earth is a computer program that renders a 3D representation of Earth based on satellite imagery.

DESCRIPTION

These vulnerabilities allows the execution of arbitrary HTML/script code to be executed in the context of the victim user's computer, and it is stored into the victim application.

PROOF OF CONCEPT 

1) Open Google Earth
2) Go to the 'Places' category
3) Right click on "Temporary Places" > Add > Folder
4) In the text-box "Name:" add a fictitious name, i.e: test2
5) Now, in the description we will insert our attack vector, using base64 to obfuscate our payload: 
    "><a/href="data:text/html;base64,Ij48c2NyaXB0PmFsZXJ0KCdYU1MnKTwvc2NyaXB0Pg== ">Click Here</a>
6) After having inserted our attack vector, we are going to save this 'Malicious Place' click on OK.

BUSINESS IMPACT

An attacker can execute arbitrary HTML or script code in a targeted user's computer, this can leverage to steal sensitive information as user credentials, personal data, etc.

SYSTEMS AFFECTED

Google Earth for Windows and Linux. MacOS X not tested.

SOLUTION

Contact vendor for a fix.

REVISION HISTORY

Nov 23, 2017 : Initial release

DISCLOSURE TIMELINE

  • Nov 23, 2017 : Vulnerability acquired by Internet Security Auditors (www.isecauditors.com).
  • Nov 23, 2017 : Contact with Google Security Team

REFERENCES

Consult these external references for further information:

LEGAL NOTICES

The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Internet Security Auditors accepts no responsibility for any damage caused by the use or misuse of this information.

ABOUT

Internet Security Auditors is a Spain and Colombia based company leader in web application testing, network security, penetration testing, security compliance implementation and assessing. Our clients include some of the largest companies in areas such as finance, telecommunications, insurance, ITC, etc. We are vendor independent provider with a deep expertise since 2001. Our efforts in R&D include vulnerability research, open security project collaboration and whitepapers, presentations and security events participation and promotion. For further information regarding our security services, contact us.