Pasar al contenido principal

2018-002: (Blind) Stored XSS on earth.google.com

 

 

2018-002: (Blind) Stored XSS on earth.google.com

Original release date: 2018 February 2nd
Last revised: 2018 August 2nd
Discovered by: Fabian Cuchietti

BACKGROUND

Google Earth is a online application that renders a 3D representation of Earth based on satellite imagery.

DESCRIPTION

These vulnerabilities allows the execution of arbitrary HTML/script code to be executed in the context of the victim user's computer, and it is stored into the victim application.

PROOF OF CONCEPT

1) Go to http://earth.google.com/web
2) Go to My Places
3) Click on Import KMZ file
4) Select our file that contains the attack vector i.e: xss.kml, and upload it.
4.1) Payload:

"><img src=x id=payload-base64 onerror=eval(atob(this.id))>

5) Click on Save
6) Preview
7) The XSS is reflected in the third-party application used for this XSS, in my case, i used XSSHUNTER.

BUSINESS IMPACT

An attacker can execute arbitrary HTML or script code in a targeted user's computer, this can leverage to steal sensitive information as user credentials, personal data, etc.

SYSTEMS AFFECTED

Current earth.google.com web application.

SOLUTION

Proper input validations.

REVISION HISTORY

Feb 02, 2018 : Initial advisory
Aug 02, 2018 : Update for disclosure

DISCLOSURE TIMELINE

  • Feb 02, 2018 : Vulnerability acquired by Internet Security Auditors
  • Feb 02, 2018 : Contact with Google Security Team
  • Feb 02, 2018 : Google feedback (won't fix)
  • Aug 02, 2018 : Vulnerability Disclosure

LEGAL NOTICES

The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Internet Security Auditors accepts no responsibility for any damage caused by the use or misuse of this information.

ABOUT

Internet Security Auditors is a Spain and Colombia based company leader in web application testing, network security, penetration testing, security compliance implementation and assessing. Our clients include some of the largest companies in areas such as finance, telecommunications, insurance, ITC, etc. We are vendor independent provider with a deep expertise since 2001. Our efforts in R&D include vulnerability research, open security project collaboration and whitepapers, presentations and security events participation and promotion. For further information regarding our security services, contact us.