Common Google XSS(matan-h.com) |
Common Google XSS(matan-h.com) |
The server response probably injected the “continue” parameter into a <meta http-equiv=“refresh” content=”0: url=…” />. Google’s bug bounty team likely would have adjusted the reward downward if it was not an XSS.
So I tried placing there continue=javascript:alert(document.domain), and… It works!
What do you think document.domain returns in this case?
It's commonly used as a placeholder in an alert-box XSS PoC. Weaponising this into an actual exploit could have been a fetch(), css inclusion, or enumerating localstorage.
says the article. If you disagree, could you elaborate why?
It has an XSS vulnerability baked in - if you add a `?continue=javascript:alert('Hi')`, you'll see a button below the easter egg text
https://matan-h.com/common-google-xss?continue=javascript:al...
Similarly, I'm kind of shocked that Google is only offering 30k for discoveries of remote code execution vulnerabilities on their own servers. I don't mean to trivialize that amount of money, but compared to the scope of what that kind of vulnerability could be used for it seems insignificant. There's the potential for access to internal Google secrets and private data belonging to users. Would a government not pay 10-20x for something like that?