Google Open Source Blog Clickjacking Vulnerability

Missing x-frame protection

            

Discovered on: 22nd, January 2017.            Research Time: 10:00 p.m to 12:00 a.m.

Earn more by display ads on blog with Lithific Ads

         Well-placed clicks can make you do unintended actions like DELETING your comments if there is no X-frame protection for any web page because it could be embedded in a frame of evil 😈websites. The attackers can place few clickable elements on the page and make the users perform sensitive actions.

I was testing on Yahoo! for vulnerabilities on 21st January and thought to check for Clickjacking vulnerability if other attacks couldn't succeed. I was successful in finding clickjacking vulnerability in one of the end points of finance.yahoo.com. I thought of submitting the bug to Yahoo! but unfortunately, this type of vulnerability was out of scope😑.

Later I thought of testing Google! because my rank was going down. It was around 10:00 p.m. I was just going through the Google Open Source blog (Domain opensource.googleblog.com), this is the place where Google updates any news about student's program or Software updates. I found that the page itself could be embedded in a frame.😉

I wrote code in HTML, CSS and Javascript. The URL of the comment section (Domain: apis.google.com) of the Blog was used as src value of <iframe> tag. Using CSS I made the comment section TRANSPARENT so that user may not know what he/she is doing. When the code is rendered in a web browser it looks like this.

When the user clicks on all the buttons the comment that the user made will be DELETED. How??

The following images show what was happening behind....

In the image below you could see the comments section hiding.
After Clicking Square 1, a drop down menu is shown. Square 2 is placed on Delete option, and after clicking on "2" an alert box would be shown whether to delete the comment or not.

Want to get icons for app Development Here  it's 

https://www.iconfinder.com/yaswanth-mangalagiri

https://www.iconfinder.com/iconsets/movie-53

https://www.iconfinder.com/iconsets/office-504

https://www.iconfinder.com/iconsets/security-259

 After clicking "3"...

The Comment will be deleted 😃

Deleting the comment is one thing in the attack scenario. What else the attackers can make the users do?

1.) Can EDIT the comments.

2.) Report  users comments as ABUSE or SPAM

3.) MUTE others.

4.) +1 on users' comments.

I reported this to Google because the blog's comment section is vulnerable as the attackers may delete, edit the user's comments.  Within 24 hours my report was triaged and sent to the product team. Again I was expecting a "$" in the reply.

After a week I got the reply from the security team...

BAD LUCK  😞😞

Earn more by display ads on blog with Lithific Ads