exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

googlecustom-xss.txt

googlecustom-xss.txt
Posted Aug 8, 2007
Authored by Lostmon | Site lostmon.blogspot.com

Google's custom search engine suffers from a cross site scripting vulnerability.

tags | exploit, xss
SHA-256 | f055badf6c13861932c4e808371522508f461a1dff85f24b1da694f6a17d4485

googlecustom-xss.txt

Change Mirror Download
#####################################################
Google custom search engine contributors invite XSS
Vendor url: http://www.google.com
Product Url: http://www.google.com/coop/cse/
Advisore url:http://lostmon.blogspot.com/2007/08/
google-custom-search-engine.html
Vendor notify :yes vendor confirmed: yes Fixed: YES
#####################################################

Description:

A Custom Search Engine is a tailored search experience,
built using Google's core search technology, which
prioritizes or restricts search results based on websites
and pages that you specify, and which can be tailored to
reflect your point of view or area of expertise.

Google Custom search Engine have a flaw that allows a remote
cross site scripting attack.This flaw exists because the
application does not validate multiple params upon submission
to multiple scripts.This could allow a user to create a specially
invite that would execute arbitrary code in a user's browser
within the trust relationship between the browser and the server,
leading to a loss of integrity.

################
timeline
###############

discovered: 31-07-2007
vendor notifY 31-07-2007
vendor response:31-07-2007
vendor fix:07-08-2007 (i test it today)
disclosure:07-08-2007

####################
explanation
###################

See this screen Shoot :

http://usuarios.lycos.es/reyfuss/xss/images/Google_custom_search_engine.jpg

Go to

http://www.google.com/coop/manage/cse/collaboration?cx=[tokem-of search engine]

and in 'Add a personal note to the invitation' write some javascript
or html code and them click on 'invite preview'
this code is execute...

Also the form convert to hexa with semicoloms to html :


it works transform to html code , but it does not execute it :)

we can try to convert it in decimal values and it show too the
html without execute it.
Only works with 'simple' html

######################### €nd ########################

Thnx To estrella To be my ligth
Thnx to all Lostmon Team !!


--
atentamente:
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Google group: http://groups.google.com/group/lostmon (new)
--
La curiosidad es lo que hace mover la mente....
Login or Register to add favorites

File Archive:

June 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    0 Files
  • 2
    Jun 2nd
    0 Files
  • 3
    Jun 3rd
    18 Files
  • 4
    Jun 4th
    21 Files
  • 5
    Jun 5th
    0 Files
  • 6
    Jun 6th
    57 Files
  • 7
    Jun 7th
    6 Files
  • 8
    Jun 8th
    0 Files
  • 9
    Jun 9th
    0 Files
  • 10
    Jun 10th
    12 Files
  • 11
    Jun 11th
    27 Files
  • 12
    Jun 12th
    38 Files
  • 13
    Jun 13th
    16 Files
  • 14
    Jun 14th
    14 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    16 Files
  • 18
    Jun 18th
    26 Files
  • 19
    Jun 19th
    15 Files
  • 20
    Jun 20th
    18 Files
  • 21
    Jun 21st
    8 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close