New issue
Advanced search Search tips

Issue 733013 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner: ----
Closed: Jun 2017
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: ----
Type: Bug-Security



Sign in to add a comment

Security: clients5.google.com exploit

Reported by tjro...@gmail.com, Jun 13 2017

Issue description

im here to notify you guys of a simple exploit around your server client management system instability, but i didnt put it through the bug bounty program as i'm not sure if it applies, has already been found, or just the fact i am not willing to accept payment. using google chromes F12 command console, it is a quite powerful tool with a built in webcrawler labeled [sources.] with this, one can even get around google's 404 error of the illegal request to browse the client files, whereas if you just open that F12 console again at that page and look in the sources, you can see the next page. then using the fact that it is a .js (javascript) you just add [filename, in this case dn].js to the end of the link giving you http://clients5.google.com/pagead/drt/dn/dn.js which allows you to browse freely at the code that is "unable to be accessed" and i havent been able to find any articles online about, but truly it only takes a newbie to use this for bad, as since i'm assuming this is an authentication code, all they have to do is take the code, [CTRL]+[F] and then look for what function creates the "good to go" sort of signal, allowing them to get into anyone's account. thank you and if at all possible get back to me either here, my other  email (goldlittlewolf@gmail.com) or through my mobile number at 1(630)9080899
 

Comment 1 by tjro...@gmail.com, Jun 13 2017

i have copied and pasted my email originally to your support and thats why it says it wasnt submitted through bug bounty even though it was. thank you for understanding

Comment 2 by est...@chromium.org, Jun 13 2017

Status: WontFix (was: Unconfirmed)
Thanks for the report! Viewing Javascript code is not a vulnerability in Chrome. Client-side web application scripts are publicly available resources and accessing the code isn't sufficient to be able to log in to anyone's account.

If I've misunderstood the report, please feel free to post more information. Thanks again.
Project Member

Comment 3 by sheriffbot@chromium.org, Sep 20 2017

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment