Google Fixes Serious Vulnerability in Gmail


Google started the new year by fixing a serious vulnerability in Gmail.

This was quite an interesting case and once again (as everything relating to web apps seems to be nowdays) it was an XSS flaw that allowed malicious attackers to steal your contact list, leading to some pretty bad information leakage.

Google has fixed a vulnerability in its popular GMail web mail service that creates a means for hackers to steal users’ contact lists.

The cross-site scripting flaw stemmed from the decision by GMail to store contact lists in a JavaScript file. GMail always saves contact lists as JavaScript code using the same URL, so a script featuring this URL can read out the fields of a users’ contact list. GMail failed to check what sites were attempting to run this “callback” function.

There was a previous very similar flaw on Google which effected computers with multiple Gmail users.

As a result users logged into GMail, or other Google services sharing the same login, are liable to hand over their contact list to spammers or other miscreants providing they are tricked into visiting a maliciously constructed website. Exploitation would have been as simple as fooling users into visiting a hostile website through spam messages sent to users’ email accounts.

Coders failed to take into account that it was a bad idea to save sensitive data as JavaScript, under predictable URLs, a problem Google watchers spotted shortly after Google made the coding changes last week

I do like Google though, they tend to fix things pretty fast!

Source: The Register

Posted in: Exploits/Vulnerabilities, Web Hacking

, , , , , ,


Latest Posts:


Axiom - Pen-Testing Server For Collecting Bug Bounties Axiom – Pen-Testing Server For Collecting Bug Bounties
Project Axiom is a set of utilities for managing a small dynamic infrastructure setup for bug bounty, basically a pen-testing server out of the box with 1-line.
Quasar RAT - Windows Remote Administration Tool Quasar RAT – Windows Remote Administration Tool
Quasar is a fast and light-weight Windows remote administration tool coded in C#. Used for user support through day-to-day administrative work to monitoring.
Pingcastle - Active Directory Security Assessment Tool Pingcastle – Active Directory Security Assessment Tool
PingCastle is a Active Directory Security Assessment Tool designed to quickly assess the Active Directory security level based on a risk and maturity framework.
Second Order - Subdomain Takeover Scanner Tool Second Order – Subdomain Takeover Scanner Tool
Second Order Subdomain Takeover Scanner Tool scans web apps for second-order subdomain takeover by crawling the application and collecting URLs (and other data)
Binwalk - Firmware Security Analysis & Extraction Tool Binwalk – Firmware Security Analysis & Extraction Tool
Binwalk is a fast and easy to use Python-based firmware security analysis tool that allows for firmware analysis, reverse engineering & extracting of firmware.
zBang - Privileged Account Threat Detection Tool zBang – Privileged Account Threat Detection Tool
zBang is a risk assessment tool for Privileged Account Threat Detection on a scanned network, organizations & red teams can use it to identify attack vectors


Comments are closed.