IAP CORS Misconfiguration Allows Email Disclosure
Published Fri, Jan 6th, 2023
Platforms
Summary
A CORS misconfiguration in Google Cloud's Identity-Aware Proxy (IAP) could have allowed attackers to disclose the email address of an authenticated user in websites protected by IAP, by convincing the user to connect to an attacker-controlled domain. This vulnerability enabled attackers to exploit CORS settings to access sensitive email information of both authenticated and unauthenticated users (with the latter requiring additional social engineering).
Affected Services
Identity-Aware Proxy (IAP)
Remediation
None required
Tracked CVEs
No tracked CVEs
References
Contributed by https://github.com/mer-b
Entry Status
finalized
Disclosure Date
Tue, May 3rd, 2022
Exploitability Period
Until July 2022
Known ITW Exploitation
-
Detection Methods
None
Piercing Index Rating
-
Discovered by
Borna Nematzadeh
