{"reporter": "Fabian Cuchietti", "enchantments": {"score": {"vector": "NONE", "value": 4.3}, "dependencies": {"references": [], "modified": "2016-11-03T10:25:54"}, "vulnersScore": 4.3}, "published": "2016-02-16T00:00:00", "cvelist": [], "lastseen": "2016-11-03T10:25:54", "history": [], "id": "PACKETSTORM:135786", "sourceHref": "https://packetstormsecurity.com/files/download/135786/googlesites-xss.txt", "objectVersion": "1.2", "sourceData": "`============================================= \nINTERNET SECURITY AUDITORS ALERT 2016-002 \n- Original release date: February 16, 2016 \n- Last revised: February 16, 2016 \n- Discovered by: Fabi\u00e1n Cuchietti \n- Severity: 6.1/10 (CVSSv3 Base Metrics) \n============================================= \n \nI. VULNERABILITY \n------------------------- \nStored XSS in Google Sites \n \nII. BACKGROUND \n------------------------- \nGoogle Sites is a structured wiki and Web page-creation tool offered by \nGoogle as part of the Google Apps for Work productivity suite. The goal \nof Google Sites is for anyone to be able to create a team-oriented site \nwhere multiple people can collaborate and share files. \n \nIII. DESCRIPTION \n------------------------- \nIt possible to bypass the restriction on JavaScript execution in Google \nwith article by embedding an <iframe> with a data and base64. The \npersistent (or stored) XSS vulnerability is a more devastating variant \nof a cross-site scripting flaw: it occurs when the data provided by the \nattacker is saved by the server, and then permanently displayed on \n\"normal\" pages returned to other users in the course of regular \nbrowsing, without proper HTML escaping. The affected resource is \nhttps://sites.google.com/isecauditorstest/ when you create/Edit a new \narticle. \n \nIV. PROOF OF CONCEPT \n------------------------- \nFirst XSS: \n \n1) Go to: https://sites.google.com/ \n2) Create > Blank template > Site Name: > Create \n3) Browse to the URL vulnerable: \nhttps://sites.google.com/site/isecauditorstest/ (example) \n4) Edit > HTML > here insert the following payload: \"><iframe \nsrc=\"data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4\"> \n5) To update \n6) PoC: https://sites.google.com/site/isecauditorstest/ \n \n \nSecond XSS: \n \n1) Browse to URL vulnerable: \nhttps://sites.google.com/site/isecauditorstest/ (example) \n2) Create Page \n3) Assign a name to your site: > Select a template: File cabinet > Create \n4) Add file > select our file * .swf > Copy the link to \"See\" \n5) PoC: \nhttps://sites.google.com/site/isecauditorstest/test-xssed/isec_flashxss.swf?attredirects=0 \n \nV. BUSINESS IMPACT \n------------------------- \nAn attacker can execute arbitrary HTML or script code in a targeted \nuser's browser. This can leverage to steal sensitive information as \ngoogle email, user credentials, personal data, etc. \n \nVI. SYSTEMS AFFECTED \n------------------------- \nhttps://sites.google.com/ \n \nVII. SOLUTION \n------------------------- \nThis vulnerability have been corrected. \n \nVIII. REFERENCES \n------------------------- \nhttp://www.owasp.org/index.php/Cross-site_Scripting_(XSS) \n \nSee Proof of Concept of exploitation in our Youtube channel. \n \nIX. CREDITS \n------------------------- \nThis vulnerability has been discovered by Fabi\u00e1n Cuchietti (ofcuchietti \n(at) isecauditors (dot) com). \n \nX. REVISION HISTORY \n------------------------- \nFebruary 16, 2016: Initial release \n \n \nXI. DISCLOSURE TIMELINE \n------------------------- \nDecember 13, 2015 Vulnerability acquired by Internet Security Auditors \nDecember 13, 2015 Contact with Google Security Team \nDecember 14, 2015 Vendor Response/Feedback \nFebruary 16, 2016 Advisory published. \n \nXII. LEGAL NOTICES \n------------------------- \nThe information contained within this advisory is supplied \"as-is\" with \nno warranties or guarantees of fitness of use or otherwise. Internet \nSecurity Auditors accepts no responsibility for any damage caused by the \nuse or misuse of this information. \n \nXIII. ABOUT \n------------------------- \nInternet Security Auditors is a Spain based leader in web application \ntesting, network security, penetration testing, security compliance \nimplementation and assessing. Our clients include some of the largest \ncompanies in areas such as finance, telecommunications, insurance, ITC, \netc. We are vendor independent provider with a deep expertise since \n2001. Our efforts in R&D include vulnerability research, open security \nproject collaboration and whitepapers, presentations and security events \nparticipation and promotion. For further information regarding our \nsecurity services, contact us. \n \nXIV. FOLLOW US \n------------------------- \nYou can follow Internet Security Auditors, news and security advisories at: \nhttps://www.facebook.com/ISecAuditors \nhttps://twitter.com/ISecAuditors \nhttp://www.linkedin.com/company/internet-security-auditors \nhttp://www.youtube.com/user/ISecAuditors \n`\n", "cvss": {"vector": "NONE", "score": 0.0}, "description": "", "references": [], "edition": 1, "title": "Google Sites Cross Site Scripting", "type": "packetstorm", "modified": "2016-02-16T00:00:00", "hash": "400c4f339c672352a8ab6d36d836627f44292cee294431a06c04b5fd12b6fa03", "bulletinFamily": "exploit", "hashmap": [{"hash": "708697c63f7eb369319c6523380bdf7a", "key": "bulletinFamily"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvelist"}, {"hash": "d4be9c4fc84262b4f39f89565918568f", "key": "cvss"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "description"}, {"hash": "1792dfae1a0564393b7e9b98c1a00a7d", "key": "href"}, {"hash": "e11b3f21a5d202703a369e574e44d345", "key": "modified"}, {"hash": "56765472680401499c79732468ba4340", "key": "objectVersion"}, {"hash": "e11b3f21a5d202703a369e574e44d345", "key": "published"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "921282df03ef34f403c083d9cd36fc3d", "key": "reporter"}, {"hash": "bc8aa0da1bbe8317b0fd571c6ded8150", "key": "sourceData"}, {"hash": "f697a7715348a942f0aff1eecc80d5ca", "key": "sourceHref"}, {"hash": "2a042ae8940289739b67ca2c5c456b2c", "key": "title"}, {"hash": "6466ca3735f647eeaed965d9e71bd35d", "key": "type"}], "href": "https://packetstormsecurity.com/files/135786/Google-Sites-Cross-Site-Scripting.html", "viewCount": 0}

{}