Two XSS vulnerabilities found in Google Cloud Platform

guest · Aug 2, 2022

A security researcher disclosed finding two vulnerabilities in the Google Cloud Platform via XSS attacks
August 1, 2022

A security researcher late last week disclosed that they found two vulnerabilities in the Google Cloud Platform, one on DevSite, the other on Google Play — bad code that could have led to hijacked accounts via cross-site scripting (XSS) attacks.

The two bugs were reported by NDevTK, who posted a tweet with a link to the researcher’s GitHub page. The researcher earned a $3,133.70 bounty for the DevSite bug and $5,000 for finding the vulnerability in Google Play.
Click to expand...

For the DevSite bug, the NDevTK said an attacker-controlled link could run JavaScript on the origins of http://cloud.google.com and http://developers.google.com, which means a bad actor could read and modify its contents, bypassing the same-origin policy.

The Google Play bug was a Document Object Model-based XSS attack. The researcher reported that on the search page of the Google Play console, vulnerable code was run when the search resulted in an error, which is fairly easy for an attacker to do.
Click to expand...

XSS attacks have been an issue for a long time and it’s proven difficult to fully eradicate them,” said Mike Parkin, senior technical engineer at Vulcan Cyber. “The more complex the code becomes, the easier it is to miss closing off all the potential vulnerabilities,” Parkin said.
Click to expand...

Log in or Sign up

Two XSS vulnerabilities found in Google Cloud Platform

guest Guest

Log in or Sign up

Two XSS vulnerabilities found in Google Cloud Platform

guest Guest

Useful Searches