Write-up: Stored and reflected XSS in Google (VRP 2011)

Summary. Looking at Google's most widely used products in 2011, I found three cross-site scripting issues: a reflected XSS in the Google Voice calling-rate lookup, a stored XSS in Google Translate's file upload, and a stored XSS through the invitee name in Google Calendar. All three were reported, verified the same day, and fixed, with a bounty awarded for the Calendar issue.

Background

In the summer of 2011 I spent a few weeks looking at Google's larger, widely used products rather than niche apps or gadgets. The goal was to find issues with broad reach, in services most Google accounts actually touch. Google's web applications were, on the whole, solid: the typical type-casting and include issues I usually look for were absent, and input was validated correctly almost everywhere I tried. I did, however, find three cross-site scripting issues, described below.

Google Voice: reflected XSS in the calling-rate lookup

Google had recently launched a service called "Google Voice", so I started there. Looking at the DOM, I found that the "Look up a calling rate" feature validated the phone number on the client side using a regular expression. That part was fine, but when the regex did not match, the validator reflected the user-supplied value back into the page, introducing a reflected cross-site scripting issue.

   Step 1: Go to https://www.google.com/voice/b/0#billing

  Step 2: Type in "/><video src=d onerror=alert(document.cookie)>"

Submitting the payload caused the reflected value to execute in the page.

Google Translate: stored XSS via file upload

The Google Translate feature at http://translate.google.com was prone to cross-site scripting when uploading files.

   Step 1: Go to http://translate.google.com

  Step 2: Select "file upload"

  Step 3: Upload a file containing JavaScript code and name it "xss.html;.txt"

Google Translate parsed the nested JavaScript before translating the rest of the file's content.

I reported the issue to Google on July 11th 2011. They verified it the same day and fixed it on July 17th. Thanks to Google Security.

Google Calendar: stored XSS via the invitee name

Calendar is tightly integrated with Gmail and lets users invite others to events. Most input fields were validated and HTML-encoded before rendering, but the invitee's first and last name, fetched from a separate profile API, were not. Placing a script payload in my own Google account's name field caused it to execute whenever that profile was shown to someone else through a calendar invite inside Gmail. In effect, anyone I invited to an event would trigger the stored payload.

I reported the issue to Google on June 22nd 2011. They verified it the same day, fixed it on June 29th and awarded a $1,000 bounty. Thanks to Google Security.

Timeline

July 11th 2011: Translate file-upload issue reported, verified the same day
July 17th 2011: Translate issue fixed
June 22nd 2011: Calendar issue reported, verified the same day
June 29th 2011: Calendar issue fixed, $1,000 bounty awarded
2011: Voice calling-rate lookup reported and fixed