Cookie Monster: Google Spreadsheets

Sick of all the XSS posts? Too bad, cause here comes another :)

This time, the victim is Google Spreadsheats, which can eat your cookies and impersonate you (on Google anyway).

Google XSS - Billy (BK) Rios

Quote:

---

Now, normally when I find an XSS vulnerability on a popular domain I just report it to the appropriate security team and move on, but this one is interesting…

By taking advantage of the content-type returned by spreadsheets.google.com (and a caching flaw on the part of Google), I was able to pull off a full blown XSS against the google.com domain. For those of you who don’t understand what this means, allow me to elaborate. When Google sets their cookie, it is valid for all of their sub domains. So, when you log into gmail (mail.google.com), your gmail cookie is actually valid for code.google.com, docs.google.com, spreadsheets.google.com…and so on. If someone (like me) finds an XSS vulnerability in any one of these sub domains, I’ll be able to hijack your session and access any google service as if I were you.

---

Screenshots, too, so it did happen (unless Photoshop was involved).

[via heise Security UK]