Google Sites Cross Site Scripting

2016-02-16T00:00:00
ID PACKETSTORM:135786
Type packetstorm
Reporter Fabian Cuchietti
Modified 2016-02-16T00:00:00

Description

                                        
                                            `=============================================  
INTERNET SECURITY AUDITORS ALERT 2016-002  
- Original release date: February 16, 2016  
- Last revised: February 16, 2016  
- Discovered by: Fabián Cuchietti  
- Severity: 6.1/10 (CVSSv3 Base Metrics)  
=============================================  
  
I. VULNERABILITY  
-------------------------  
Stored XSS in Google Sites  
  
II. BACKGROUND  
-------------------------  
Google Sites is a structured wiki and Web page-creation tool offered by  
Google as part of the Google Apps for Work productivity suite. The goal  
of Google Sites is for anyone to be able to create a team-oriented site  
where multiple people can collaborate and share files.  
  
III. DESCRIPTION  
-------------------------  
It possible to bypass the restriction on JavaScript execution in Google  
with article by embedding an <iframe> with a data and base64. The  
persistent (or stored) XSS vulnerability is a more devastating variant  
of a cross-site scripting flaw: it occurs when the data provided by the  
attacker is saved by the server, and then permanently displayed on  
"normal" pages returned to other users in the course of regular  
browsing, without proper HTML escaping. The affected resource is  
https://sites.google.com/isecauditorstest/ when you create/Edit a new  
article.  
  
IV. PROOF OF CONCEPT  
-------------------------  
First XSS:  
  
1) Go to: https://sites.google.com/  
2) Create > Blank template > Site Name: > Create  
3) Browse to the URL vulnerable:  
https://sites.google.com/site/isecauditorstest/ (example)  
4) Edit > HTML > here insert the following payload: "><iframe  
src="data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4">  
5) To update  
6) PoC: https://sites.google.com/site/isecauditorstest/  
  
  
Second XSS:  
  
1) Browse to URL vulnerable:  
https://sites.google.com/site/isecauditorstest/ (example)  
2) Create Page  
3) Assign a name to your site: > Select a template: File cabinet > Create  
4) Add file > select our file * .swf > Copy the link to "See"  
5) PoC:  
https://sites.google.com/site/isecauditorstest/test-xssed/isec_flashxss.swf?attredirects=0  
  
V. BUSINESS IMPACT  
-------------------------  
An attacker can execute arbitrary HTML or script code in a targeted  
user's browser. This can leverage to steal sensitive information as   
google email, user credentials, personal data, etc.  
  
VI. SYSTEMS AFFECTED  
-------------------------  
https://sites.google.com/  
  
VII. SOLUTION  
-------------------------  
This vulnerability have been corrected.  
  
VIII. REFERENCES  
-------------------------  
http://www.owasp.org/index.php/Cross-site_Scripting_(XSS)  
  
See Proof of Concept of exploitation in our Youtube channel.  
  
IX. CREDITS  
-------------------------  
This vulnerability has been discovered by Fabián Cuchietti (ofcuchietti  
(at) isecauditors (dot) com).  
  
X. REVISION HISTORY  
-------------------------  
February 16, 2016: Initial release  
  
  
XI. DISCLOSURE TIMELINE  
-------------------------  
December 13, 2015 Vulnerability acquired by Internet Security Auditors  
December 13, 2015 Contact with Google Security Team  
December 14, 2015 Vendor Response/Feedback  
February 16, 2016 Advisory published.  
  
XII. LEGAL NOTICES  
-------------------------  
The information contained within this advisory is supplied "as-is" with  
no warranties or guarantees of fitness of use or otherwise. Internet  
Security Auditors accepts no responsibility for any damage caused by the  
use or misuse of this information.  
  
XIII. ABOUT  
-------------------------  
Internet Security Auditors is a Spain based leader in web application  
testing, network security, penetration testing, security compliance  
implementation and assessing. Our clients include some of the largest  
companies in areas such as finance, telecommunications, insurance, ITC,  
etc. We are vendor independent provider with a deep expertise since  
2001. Our efforts in R&D include vulnerability research, open security  
project collaboration and whitepapers, presentations and security events  
participation and promotion. For further information regarding our  
security services, contact us.  
  
XIV. FOLLOW US  
-------------------------  
You can follow Internet Security Auditors, news and security advisories at:  
https://www.facebook.com/ISecAuditors  
https://twitter.com/ISecAuditors  
http://www.linkedin.com/company/internet-security-auditors  
http://www.youtube.com/user/ISecAuditors  
`