A Google Docs Bug Could Have Allowed Hackers See Your Private Documents

guest · Dec 30, 2020

A Google Docs Bug Could Have Allowed Hackers See Your Private Documents
December 29, 2020
https://thehackernews.com/2020/12/a-google-docs-bug-could-have-allowed.html

Google has patched a bug in its feedback tool incorporated across its services that could be exploited by an attacker to potentially steal screenshots of sensitive Google Docs documents simply by embedding them in a malicious website.

The flaw was discovered on July 9 by security researcher Sreeram KL, for which he was awarded $3133.70 as part of Google's Vulnerability Reward Program.
Click to expand...

Many of Google's products, including Google Docs, come with a "Send feedback" or "Help Docs improve" option [...] the feedback feature is deployed in Google's main website ("www.google.com") and integrated to other domains via an iframe element that loads the pop-up's content from "feedback.googleusercontent.com."

Sreeram, however, identified a bug in the manner these messages were passed to "feedback.googleusercontent.com," thus allowing an attacker to modify the frame to an arbitrary, external website, and in turn, steal and hijack Google Docs screenshots which were meant to be uploaded to Google's servers.
Click to expand...

[Google VRP] Hijacking Google Docs Screenshots

I was able to hijack Google Docs screenshot of any document exploiting postmessage misconfiguration and a browser behavior.
Click to expand...

Log in or Sign up

A Google Docs Bug Could Have Allowed Hackers See Your Private Documents

guest Guest

Log in or Sign up

A Google Docs Bug Could Have Allowed Hackers See Your Private Documents

guest Guest

Useful Searches