Google account hijacking via exploitation of XSS flaw

Security Expert Brett Buerhaus has discovered a critical flaw on admin.google.com, which could be exploited by to Hijack an account and disable 2FA Authentication.

Even the giants have their Achilles heel, the Google Apps administrator console is affected by a critical cross-site scripting (XSS) vulnerability that could be exploited by attackers to force a Google Apps admins to execute request on the https://admin.google.com/ domain.

The unknown flaw was first discovered by application security engineer Brett Buerhaus that reported it to Google on September 1st. Google promptly resolved the problem and fixed the flaw within 17 days. Buerhaus received by Google $5,000 as a reward under its bug bounty program.

The Google Apps admin console is the instrument used by administrators to manage their corporate account, it allows to add new users, enable Google services the domain, configure permissions and manage security settings.

The XSS flaw allowed attackers to force the admin to do the following actions:

Creating new users with “super admin” rights.
Modifying domain settings to hijack incoming e-mails to addresses controlled by the attacker.
Configure security settings for existing accounts or from multiple domains, including two-factor authentication.
Account/email takeover by resetting the password, disabling 2FA, and also disabling login challenges temporarily for 10 minutes

Buerhaus explained that if users are not authorized to use a specific service they will be presented with a “ServiceNotAllowed” page, the expert explained that this page could be exploited to switch between accounts in order to log in to the service.

“The ServiceNotAllowed page appears when you are attempting to access a Google app service that has not been configured for your domain. It requires that you are logged into at least two accounts and will give you a form to switch accounts to continue to the service you were trying to load.” said Buerhaus in a blog post.

When the user selects one of the accounts, a piece of JavaScript code was executed to redirect its Web browser, but the JavaScript code could be supplied by the user in the “continue” request parameter of the URL, which results vulnerable to XSS attacks.

“When you select an account via the bullet on the page, it executes JavaScript to redirect your browser. The URL used in this JavaScript is supplied by the user in the continue request parameter.The continue request parameter is fairly common request variable in the Google login flow. This is the only page that I could find that did not validate the URL passed into it. This allowed you to craft Cross-Site Scripting attacks by using “javascript:” as part of the URL and it would execute when the browser location is redirected.” continues the post.

Buerhaus created a proof-of-concept that use a JavaScript payload to syphon data from the Admin console, grabbing a list of users, changing the password and removing security settings a user.

Pierluigi Paganini

(Security Affairs – Google XSS, Google Apps)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.