full-disclosure-uk August 2008 archive
Main Archive Page > Month Archives  > full-disclosure-uk archives
full-disclosure-uk: [Full-disclosure] Google Notebook and Google

[Full-disclosure] Google Notebook and Google Bookmarks Cross Site Scripting Vulnerabilities

From: Alfredo Melloni <alfredo.melloni_at_nospam>
Date: Wed Aug 06 2008 - 15:39:13 GMT
To: full-disclosure@lists.grok.org.uk


Google Notebook and Google Bookmarks Cross Site Scripting Vulnerabilities

I. Background:

Google Notebook is a service where it's possible to "add text, images, and links from web pages without leaving your browser window." Google Bookmarks is a service where it's possible to save bookmarks.

II. Description:
Three cross site scripting vulnerabilities were identified inside Google Notebook. A remote attacker can make a malformed block notes and invite, through the sharing option inside Google Notebook, other users to see it to obtain their cookie. User interaction is required to exploit all three vulnerabilies.

Browser affected: Firefox 3.
Browser not affected: Internet Explorer 7, Opera 9.5, Safari 3.

One cross site scripting vulnerability was identified inside Google Bookmarks. A remote attacker can make a malformed bookmark inside his account and then share it with other users to obtain their cookie. User interaction is required to exploit this vulnerability.

Browser affected: Mozilla Firefox 3, Internet Explorer 7, Opera 9.5, Safari 3

III. Vendor Response:
Google acknowledged 4 vulnerabilities and has deployed a fix for them.

IV. Disclosure timeline: 23/07/08 - First vulnerability discovered 23/07/08 - Google informed 24/07/08 - Google confirmed first bug 31/07/08 - Google fixed the first vulnerability 31/07/08 - Three new vulnerabilities discovered 31/07/08 - Google informed 31/07/08 - Google confirmed these three new bugs 01/08/08 - Google fixed all vulnerabilities submitted

Regards
Alfredo Melloni



Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/