Researcher reveals Google Maps Vulnerability

guest · Sep 8, 2020

Researcher reveals Google Maps XSS bug, patch bypass
September 8, 2020
https://www.zdnet.com/article/researcher-reveals-google-maps-xss-bug-patch-bypass/

Google has resolved an XSS vulnerability in Google Maps that was reported through the tech giant's bug bounty program.

Google's Vulnerability Reward Programs (VRP) provides a platform for third-party researchers to disclose security issues in Google services and products privately, in return for a financial reward and credit.
However, this wasn't the end of the security problem.

"I was genuinely surprised the bypass was so simple," the researcher noted. "I reported it so quickly (literally 10 minutes between checking my mailbox and reporting a bypass), that right after sending this mail I started doubting myself."
Roughly two hours after sending a fresh query with his findings, the researcher was told the case was being reopened.
Click to expand...

The first XSS issue was reported to Google on April 23. By April 27, Google's VRP team had accepted the vulnerability as legitimate, issuing the first fix and reward by June 7. The bypass of the original patch was reported on the same day, and after being resolved, the researcher received his second payout on June 18.

Each vulnerability earned Shachar $5,000, for a total reward of $10,000.

"Ever since this Google Maps fix bypass incident I started to always re-validate fixes, even for simple things, and it has been paying off," Shachar says. "I full-heartedly encourage you to do the same."
Click to expand...

XSS->Fix->Bypass: 10000$ bounty in Google Maps

Google Maps ‘export as KML’
One of the many features offered by Google Maps is creating your own map.

We can see we receive an XML response (with some KML tags inside), and that our map name (probably as it contains special chars such as ‘<’) is contained within a CDATA tag, which means our code will not be rendered by the browser. But wait. How do you ‘close’ a CDATA tag?

I found that by adding special chars, you can ‘close’ the CDATA tag. Specifically, by adding ‘]]>’ at the beginning of your payload (I.e. as the beginning of the ‘map name’), you can escape from the CDATA and add arbitrary XML content (which will be rendered as XML) - leading immediately to XSS (for example with a simple SVG XSS payload).
Click to expand...

Log in or Sign up

Researcher reveals Google Maps Vulnerability

guest Guest

Log in or Sign up

Researcher reveals Google Maps Vulnerability

guest Guest

Useful Searches