6 ms·

It's definitely a vulnerability, but to be a little more grounded in reality, to exploit this you need to somehow convince your victim to go to your website whi

It's definitely a vulnerability, but to be a little more grounded in reality, to exploit this you need to somehow convince your victim to go to your website which contains the document you're trying to get access to. So for this to work you need to know the document ID, and also the person who owns this document. You then need to trick them into looking at their document on your domain, and then from there, need to persuade them somehow to press the send feedback button. I'd also note that the feedback button is a button that I suspect very very few people ever press. I certainly never have. I also don't know the IDs to any documents I might find interesting but can't read, and if I find a document via some random google search that I can't look at, I generally have no way of knowing how to contact the owner so I can try to send them phishing emails to get them to look at their document on a non-google URL. There's been a bunch of cases where google has paid out very substantial bounties, and given the extreme difficulty of both meeting the attack prereqs and then managing to pull off a very sketchy exploit process at the same time I think the sum paid is more than fair.

treeman79 6y ago
Way easier to convince customer to share the document.
- foolmeonce 6y ago
  True, but I think a business account can disable the simple "share" to outside accounts and there would be more logs (of the type the business would be able to see) of what happened. These exploits are often not so interesting as written and with current normal setups, but eventually become more interesting if never fixed.
  - tptacek 6y ago
    Can you lay out a realistic exploitation scenario for this bug? It seems to have several predicates: 1. You need to know the document ID you're targeting (Stack Exchange once worked the ID out to ~256 bits). 2. You have to get the victim to interact with a Google doc on a site that you control (you need to re-dress the Google Docs interface, get the victim to your site, and then have them treat your site as if it was Google Docs). 3. You need to get the victim to use the Google feedback feature in order to trigger the vulnerable postMessage. What's a scenario in which an attacker gets these stars to align? (I'm sure there is one).
    - foolmeonce 6y ago
      Sure, why not: 1. I go to a job interview at a company that uses a chromebook with a restricted account. The interviewer sits next to me as I go through the process. 2. As we go through the steps in a google document, I need something from my resume on my website. I fumble with the URL bar slightly which hopefully has the doc ID, possibly because I once closed the document "by accident" and brought it back up. 3. While discussing whatever brought us to my website, I click on something but act like I am switching tabs. 4. At the end of the process in their document, I point out how strange the Google Docs looks now and press the feedback button to show my corporate soft skills. 5. The companies hiring interview document is now floating around my school and in 10 years half of their engineering is my Alma Mater.
      - refulgentis 6y ago
        This is implausible as well, no one simply 'goes to a company', offices are long gone.
      - pvg 6y ago
        At that level of realism there are much more efficient attacks https://i.imgur.com/lkUV5Mf.jpg https://i.imgur.com/lkUV5Mf.jpg
tptacek 6y ago
Oh, I didn't even think about this, but I think you're right: there's no generic way of iframing a victim where you can see all their document IDs. This doesn't seem very plausible.
gibba999 6y ago
I'm on cc: lists with documents I don't have access to all the time. It depends on how organizations interact. And I suspect it wouldn't be very hard for me to iframe Google Docs and appropriately obscure things so someone does, indeed, click where I want. $3.3k is about a week's worth of time for a poorly-paid developer before overhead. It's not reasonable. At those rates, the only people who will be able to afford to be paid to do security work on Google products will be ones who sell on the gray/black market. The whole point of bounties was to give a path without the need for that.

treeman79 6y ago

Way easier to convince customer to share the document.

foolmeonce 6y ago
True, but I think a business account can disable the simple "share" to outside accounts and there would be more logs (of the type the business would be able to see) of what happened. These exploits are often not so interesting as written and with current normal setups, but eventually become more interesting if never fixed.
- tptacek 6y ago
  Can you lay out a realistic exploitation scenario for this bug? It seems to have several predicates: 1. You need to know the document ID you're targeting (Stack Exchange once worked the ID out to ~256 bits). 2. You have to get the victim to interact with a Google doc on a site that you control (you need to re-dress the Google Docs interface, get the victim to your site, and then have them treat your site as if it was Google Docs). 3. You need to get the victim to use the Google feedback feature in order to trigger the vulnerable postMessage. What's a scenario in which an attacker gets these stars to align? (I'm sure there is one).
  - foolmeonce 6y ago
    Sure, why not: 1. I go to a job interview at a company that uses a chromebook with a restricted account. The interviewer sits next to me as I go through the process. 2. As we go through the steps in a google document, I need something from my resume on my website. I fumble with the URL bar slightly which hopefully has the doc ID, possibly because I once closed the document "by accident" and brought it back up. 3. While discussing whatever brought us to my website, I click on something but act like I am switching tabs. 4. At the end of the process in their document, I point out how strange the Google Docs looks now and press the feedback button to show my corporate soft skills. 5. The companies hiring interview document is now floating around my school and in 10 years half of their engineering is my Alma Mater.
    - refulgentis 6y ago
      This is implausible as well, no one simply 'goes to a company', offices are long gone.
    - pvg 6y ago
      At that level of realism there are much more efficient attacks https://i.imgur.com/lkUV5Mf.jpg https://i.imgur.com/lkUV5Mf.jpg

tptacek 6y ago

Oh, I didn't even think about this, but I think you're right: there's no generic way of iframing a victim where you can see all their document IDs. This doesn't seem very plausible.

gibba999 6y ago

I'm on cc: lists with documents I don't have access to all the time. It depends on how organizations interact. And I suspect it wouldn't be very hard for me to iframe Google Docs and appropriately obscure things so someone does, indeed, click where I want. $3.3k is about a week's worth of time for a poorly-paid developer before overhead. It's not reasonable. At those rates, the only people who will be able to afford to be paid to do security work on Google products will be ones who sell on the gray/black market. The whole point of bounties was to give a path without the need for that.