0

I have discovered persistent XSS in blogger domain. I have reported vulnerability to Google Security Team and I received this is the response:

Users are permitted to place arbitrary JavaScript, Flash, Java, etc, in their [username].blogspot.com domains; this is by design. These domains are fully isolated from other Google content, and therefore, the risk in visiting them is no different to navigating to any other website on the Internet.

Note that there are no authentication cookies or other sensitive information in these domains; blog management is implemented on blogger.com, instead."

The domain mentioned in your submission is what we call a 'sandbox domain'. These are meant specifically to host user-controlled and potentially malicious content and are isolated from any sensitive data, thanks to Same Origin Policy restrictions

So obviously I did not received the bounty, however I would like to ask what other attack vectors can be useful for attackers in this case apart from phishing?

3

If you made your content malicious, and you have enticed a user to visit your blog then you have already succeeded with your attack.

This is just the same as hosting your own website containing malicious content and enticing a user to visit it. The only advantage may be if your target user is likely to trust a *.blogspot.com domain more than any other arbitrary one.

Discounting phishing (e.g. showing a username and password box and asking the user to log into their Google account), the type of attacks you could launch are:

Again, as the user has to go to your site first they must have some basic trust in it, so I agree with Google in that any malicious code can only compromise the sandbox domain, which does not have any concept of user sessions or sensitive data itself.

1

Keyloggers in JavaScript... BeEF injection string (a JavaScript string to allow BeEF to "hook" the browser..."

Also.... you can redirect them to www.myevilsite.org (we're an organization ya know.. we've incorporated...) and do whatever they want to you SOP or not and return you right back to the google site w/the end user being none-the-wiser.

Google can get bent on this one, IMO.

  • 4
    How so? I totally agree with Google that this is not different from you setting up your own website where you have full control over your malicious js. If he was able to inject persistent xss on some other blog without editing access that would be a different story. – efr4k Jul 30 '15 at 13:54
  • 1
    well... to start, I never claimed it was "any different from (you) setting up your own site, etc." and I don't think that was the question... or really even relevant. If, as an end user, I am aware that I'm going to www.frediscool.com then I know I have to be aware that it could be compromised or intentionally malicious... however when I go to a google controlled/owned site I expect security in every regard unless Google specifies and states to all those about to visit it, otherwise. So, yes, it is somewhat different, if not in a technical manner, but in practice. I stand by my reply. – RatboySTL Jul 30 '15 at 14:01
  • 2
    a problem with this is how can you have a blogging platform that doesn't allow people to create content in their blogs? If a user can create content , they can create redirections... Most/all blogging platforms I've seen would allow users (on their own blogs) to upload rich content (flash/Javascript etc) – Rоry McCune Jul 30 '15 at 14:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.