There is a persistent cross-site scripting vulnerability in Gmail, a serious bug the Google security team has now fixed.
The vulnerability is one of three XSS flaws security researcher, Nils Juenemann, discovered and reported to Google.
The persistent XSS in Gmail, Google’s popular webmail service, could give an attacker the ability to run malicious scripts on a victim’s machine. Cross-site scripting vulnerabilities are some of the most common bugs in Web applications. Typical XSS bugs can be dangerous, depending upon the application and the user base. But persistent XSS flaws are even more serious as they can store attacker code on target servers.
RELATED STORIES
DDoS Makes Product Improvement
DoS Tool Takes Out Web Host
Google Rolls Out Attack Warning
Google: Web Sites Hacked
Juenemann discovered there was a way for an attacker to get access to several key pieces of information in the URLs that Gmail generates when it displays a message to a user. When a message displays directly, rather than as part of a user’s inbox, it contains a static user ID and an identifier for the individual message. Those values shouldn’t be available to an attacker, but Juenemann found he could get them through referrer leaks.
“An attacker doesn’t know the ik and the message id,” Juenemann said. “Without both values it’s not possible to generate the special URL. But it’s easy to get both values through referer leaking. We have to send to our victim a HTML email with that content.”
When the user opens the email message, the GIF image will send the user ID and message ID to the attacker’s server. The second URL also will leak that data if the user clicks on it. The script will then display a Javascript alert, and that’s the attacker’s code running in the context of Gmail.
Juenemann said the Google security team moved quickly to fix that bug, as well as the other two XSS flaws he discovered, which were somewhat less serious.
“The Google Security Team took immediately actions and blocked the particular GET parameter on their frontends as intermediate fix with the message: ‘We’re sorry … but your computer or network may be sending automated queries. To protect our users, we can’t process your request right now, ‘” he said.