medium
GCP Cloudshell XSS and CSRF bugs
Published Sun, Dec 15th, 2019
Platforms
Summary
GCP Cloudshell has been affected by various XSS and CSRF vulnerabilities stemming from different root causes related to authentication handling, markdown editing, file uploading and more. Explotiation of these vulnerabilities normally requires user interaction through social engineering (convincing a potential victim to click a malicious link).
Affected Services
GCP Cloudshell
Remediation
null
Tracked CVEs
No tracked CVEs
References
https://obmiblog.blogspot.com/2022/12/gcp-2022-few-bugs-in-google-cloud-shell.htmlhttps://obmiblog.blogspot.com/2019/12/gcp-5k-file-uploading-csrf.htmlhttps://obmiblog.blogspot.com/2019/12/gcp-5k-oauth-token-hijack.htmlhttps://obmiblog.blogspot.com/2019/12/gcp-5k-xss-type-ii.htmlhttps://security.googleblog.com/2023/06/google-cloud-awards-313337-in-2022-vrp.html
Contributed by https://github.com/mer-b
Entry Status
Finalized
Disclosure Date
-
Exploitability Period
-
Known ITW Exploitation
-
Detection Methods
None
Piercing Index Rating
-
Discovered by
Obmi
More vulnerabilities...
medium
ALB HTTP request smuggling
ALBs found vulnerable to HTTP request smuggling (desync attack).
James Kettle (Portswigger),...