Issue metadata
Sign in to add a comment
|
Security: clients5.google.com exploit
Reported by
tjro...@gmail.com,
Jun 13 2017
|
||||||||||||||||||
Issue descriptionim here to notify you guys of a simple exploit around your server client management system instability, but i didnt put it through the bug bounty program as i'm not sure if it applies, has already been found, or just the fact i am not willing to accept payment. using google chromes F12 command console, it is a quite powerful tool with a built in webcrawler labeled [sources.] with this, one can even get around google's 404 error of the illegal request to browse the client files, whereas if you just open that F12 console again at that page and look in the sources, you can see the next page. then using the fact that it is a .js (javascript) you just add [filename, in this case dn].js to the end of the link giving you http://clients5.google.com/pagead/drt/dn/dn.js which allows you to browse freely at the code that is "unable to be accessed" and i havent been able to find any articles online about, but truly it only takes a newbie to use this for bad, as since i'm assuming this is an authentication code, all they have to do is take the code, [CTRL]+[F] and then look for what function creates the "good to go" sort of signal, allowing them to get into anyone's account. thank you and if at all possible get back to me either here, my other email (goldlittlewolf@gmail.com) or through my mobile number at 1(630)9080899
,
Jun 13 2017
Thanks for the report! Viewing Javascript code is not a vulnerability in Chrome. Client-side web application scripts are publicly available resources and accessing the code isn't sufficient to be able to log in to anyone's account. If I've misunderstood the report, please feel free to post more information. Thanks again.
,
Sep 20 2017
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||
Comment 1 by tjro...@gmail.com
, Jun 13 2017