XSS at Blogger
One fine night when I was editing my Blogger Account I found an awkward behavior. Upon digging a bit, I discovered an XSS vulnerability that could be exploited using data URIs [...]
XSS at Blogger
One night when I was editing my Blogger Account I found an weird behavior. This caught my eye and upon digging a bit… BOOM!
POC
The vulnerable link was:
1
https://www.blogger.com/switch-profile.g?switchProfileSource=3&continue=/home
Now, let’s change this “continue”’s value to:
1
https://www.google.com/
And it redirects to:
1
https://www.google.com/
Let me try something else with data URI:
1
data:text/html;base64,......
AND… BOOM!
Snapshots
Results
I wasn’t rewarded a bounty because of it being a browser issue and Same Origin Policy which prevents exploitation. Thanks to Google Security Team for fixing the bug in matter of days and listing me in Hall Of Fame!
This post is licensed under CC BY 4.0 by the author.