Researcher details easy-to-exploit bug that exposed GSuite accounts to full takeover

guest · Nov 11, 2021

‘Add yourself as super admin’ – Researcher details easy-to-exploit bug that exposed GSuite accounts to full takeover
Technical details of long-since patched Google cloud software vulnerability released
November 11, 2021
https://portswigger.net/daily-swig/...that-exposed-gsuite-accounts-to-full-takeover

A security researcher has released details of a high-impact, but long-since patched vulnerability in Google’s GSuite that allowed an attacker to add themselves as a super admin on any organization’s account.

Back in 2018, researcher Cameron Vincent was probing Google’s attack surface for bugs under the tech giant’s Vulnerability Reward Program (VRP).
Click to expand...

The object of his attention was GSuite – Google’s suite of cloud computing, productivity, and collaboration tools that was rebranded as Workspace last year – particularly the domain.google.com registrar feature.

“In GSuite the main admins of the organization are super admins,” Vincent explains in a blog post published this week (November 9). “They can create group[s], manage users, change users’ passwords, [and] manage everything.”
Click to expand...

He decided to release the details this week as part of a wider project to revisit his previous security research under Google and Microsoft’s bug bounty programs.

“It was properly disclosed through Google’s VRP program and was given a bounty,” he said.

Click to expand...

Log in or Sign up

Researcher details easy-to-exploit bug that exposed GSuite accounts to full takeover

guest Guest

Log in or Sign up

Researcher details easy-to-exploit bug that exposed GSuite accounts to full takeover

guest Guest

Useful Searches