Summary
A vulnerability in Google's common JavaScript library allowed bypassing domain validation checks across multiple Google products. By using a backslash character in URLs, an attacker could make the regex parser and browser disagree on the authority (domain) portion of a URL, allowing injection of arbitrary domains that pass whitelisting checks.
Affected Services
Cloud Console, GMail API, Actions Console, YouTube Studio, Google Accounts
Remediation
None required
Tracked CVEs
No tracked CVEs
References
https://feed.bugs.xdavidhu.me/bugs/0008https://bugs.xdavidhu.me/google/2020/03/08/the-unexpected-google-wide-domain-check-bypass/
Contributed by https://github.com/korniko98
Entry Status
Stub (AI-Generated)
Disclosure Date
Sat, Jan 4th, 2020
Exploitablity Period
Until 2020/03/06
Known ITW Exploitation
-
Detection Methods
Monitor for unexpected URL parsing behaviors, especially URLs containing backslash characters between the authority and path components.
Piercing Index Rating
-
Discovered by
David Schütz
