3 ms·

True, but I think a business account can disable the simple "share" to outside accounts and there would be more logs (of the type the business would be able to

True, but I think a business account can disable the simple "share" to outside accounts and there would be more logs (of the type the business would be able to see) of what happened. These exploits are often not so interesting as written and with current normal setups, but eventually become more interesting if never fixed.

tptacek 6y ago
Can you lay out a realistic exploitation scenario for this bug? It seems to have several predicates: 1. You need to know the document ID you're targeting (Stack Exchange once worked the ID out to ~256 bits). 2. You have to get the victim to interact with a Google doc on a site that you control (you need to re-dress the Google Docs interface, get the victim to your site, and then have them treat your site as if it was Google Docs). 3. You need to get the victim to use the Google feedback feature in order to trigger the vulnerable postMessage. What's a scenario in which an attacker gets these stars to align? (I'm sure there is one).
- foolmeonce 6y ago
  Sure, why not: 1. I go to a job interview at a company that uses a chromebook with a restricted account. The interviewer sits next to me as I go through the process. 2. As we go through the steps in a google document, I need something from my resume on my website. I fumble with the URL bar slightly which hopefully has the doc ID, possibly because I once closed the document "by accident" and brought it back up. 3. While discussing whatever brought us to my website, I click on something but act like I am switching tabs. 4. At the end of the process in their document, I point out how strange the Google Docs looks now and press the feedback button to show my corporate soft skills. 5. The companies hiring interview document is now floating around my school and in 10 years half of their engineering is my Alma Mater.
  - refulgentis 6y ago
    This is implausible as well, no one simply 'goes to a company', offices are long gone.
  - pvg 6y ago
    At that level of realism there are much more efficient attacks https://i.imgur.com/lkUV5Mf.jpg https://i.imgur.com/lkUV5Mf.jpg

tptacek 6y ago

Can you lay out a realistic exploitation scenario for this bug? It seems to have several predicates: 1. You need to know the document ID you're targeting (Stack Exchange once worked the ID out to ~256 bits). 2. You have to get the victim to interact with a Google doc on a site that you control (you need to re-dress the Google Docs interface, get the victim to your site, and then have them treat your site as if it was Google Docs). 3. You need to get the victim to use the Google feedback feature in order to trigger the vulnerable postMessage. What's a scenario in which an attacker gets these stars to align? (I'm sure there is one).

foolmeonce 6y ago
Sure, why not: 1. I go to a job interview at a company that uses a chromebook with a restricted account. The interviewer sits next to me as I go through the process. 2. As we go through the steps in a google document, I need something from my resume on my website. I fumble with the URL bar slightly which hopefully has the doc ID, possibly because I once closed the document "by accident" and brought it back up. 3. While discussing whatever brought us to my website, I click on something but act like I am switching tabs. 4. At the end of the process in their document, I point out how strange the Google Docs looks now and press the feedback button to show my corporate soft skills. 5. The companies hiring interview document is now floating around my school and in 10 years half of their engineering is my Alma Mater.
- refulgentis 6y ago
  This is implausible as well, no one simply 'goes to a company', offices are long gone.
- pvg 6y ago
  At that level of realism there are much more efficient attacks https://i.imgur.com/lkUV5Mf.jpg https://i.imgur.com/lkUV5Mf.jpg