Friday, October 11, 2013

Google Mail Hacking - Stored XSS in GMail for iOS



Hi! Just want to share my finding, I have found Stored XSS Vulnerability in GMail for iOS. With no user interaction, enjoy ;-)

GMail for iOS contained an XSS vulnerability in its “Mail Attachment” feature. This bug was reported to Google Security Team, fixed immediately.


About

Title: Stored XSS in GMail for iOS
Business Risk: High
Discovery Date: October 8, 2013
Payload: <img src=x onerror=alert(0)>
Author: Roy Castillo (me)

Steps to Reproduce


1. Login to Google Analytics
2. Create an account and name it <img src=x onerror=alert(0)>
3. Go to Reporting -> Real Time -> Overview -> Email
4. Send an email to the victim GMail address.


5. Open your GMail for iOS
6. Open the received email.
7. XSSED



Stored XSS in GMail for iOS

The filename of the attachment was not escaped correctly and I was able to get the Stored XSS triggered. By using the generated report from Google Analytics I could inject script code that was executed on mail.google.com. The XSS is stored just simply reopen the mail anytime you want.

Google Security Team was pretty fast to address this issue and resolved this the next day itself. Google Security team awarded this bug with $5000.



Achievement unlocked: $5000 reward for XSS at google.com ;)

Thank you Google Security Team!

Disclosure Timeline

October 8, 2013 at 6:14 AM (GMT +08:00): Vulnerability Discovered
October 8, 2013 at 2:59 PM (GMT +08:00): Initial Report
October 8, 2013 at 2:59 PM (GMT +08:00): Autorespose from Security bot
October 9, 2013 at 12:17 AM (GMT +08:00): First response from Security Team
October 9, 2013 at 7:45 AM (GMT +08:00): Bounty Rewarded.
October 10, 2013: Vulnerability Fixed
October 12, 2013: Full Disclosure Published



Best,

Roy Castillo

1,120 comments:

  1. :D nice one, congratulations on the bounty.

    ReplyDelete
  2. Man your bugs are cool . I like the way you think :D

    ReplyDelete
  3. Amazing! I never image onError can run. Really smart! But is run just because you send through Google Analytics, right?

    ReplyDelete
  4. The personal items are always important to be stored in the first place. So, if you’ve rented a storage space or thought about it, the time is right now for you to consider insurance options since some renting facilities will not cover your stuff.
    Storage in Vancouver, WA

    ReplyDelete
  5. Copied your bug report blog post into http://bughunters.thebestbug.com/index.php?title=Bug3-Google_Mail_Hacking_-_Stored_XSS_in_GMail_for_iOS (trying a wiki with bugs rewarded). hope you are ok with it and maybe you can add entries there yourself

    ReplyDelete
  6. Thanks for the blog...very nice description about Online Tech Support...Good luck!!!
    For Online Tech Support,please follow the website: Gmail Technical Support

    Thankyou
    Lacy Brown

    ReplyDelete
  7. Thanks to post this article. Mobile Application Development is play great role in business.Great job.keep it up.

    ReplyDelete
  8. There are also other options you can choose here too, but the ones I use the most are Skip the Inbox and Apply the Label. https://www.behance.net/gallery/40444073/Change-Or-Reset-Your-Google-Account-Password?

    ReplyDelete
  9. Finding the time and actual effort to create a superb article like this is great thing. I’ll learn many new stuff right here! Good luck for the next post buddy..
    IOS Training in Chennai

    ReplyDelete
    Replies
    1. wow give me training..hey please sent me some auto approval backlinks.
      www.umangseo5008@gmail.com

      Delete
  10. Thank you for taking the time and sharing this information with us. It was indeed very helpful and insightful while being straight forward and to the point.
    Mcdonalds gutscheine | Startlr | salud limpia

    ReplyDelete
  11. It is amazing and wonderful to visit your site.Thanks for sharing this information,this is useful to me...
    Android Training in Chennai
    Ios Training in Chennai

    ReplyDelete
  12. Wow very nice blog and got great idea about gmail hacking....
    IOS course in chennai

    ReplyDelete
  13. If you want your ex-girlfriend or ex-boyfriend to come crawling back to you on their knees (even if they're dating somebody else now) you must watch this video
    right away...

    (VIDEO) Have your ex CRAWLING back to you...?

    ReplyDelete
  14. http://www.yahoosuppotphonenumber.net /
    Yahoo Support Phone Number
    Yahoo is useful platform for its users. While users use their yahoo platform they can get enhanced services because yahoo provides better and the most updated services for all its users. Even though it is user oriented but for better experience it makes sure that customized and personalized services can be enabled for each of its users.

    ReplyDelete
  15. I wish to show thanks to you just for bailing me out of this particular trouble. As a result of checking through the net and meeting techniques that were not productive, I thought my life was done.
    nebosh course in chennai

    ReplyDelete
  16. Great content thanks for sharing this informative blog which provided me technical information keep posting.
    python course in pune
    python course in chennai
    python course in Bangalore

    ReplyDelete
  17. Webroot antivirus is one of the mostly increasing antivirus programs, which has become well-known in no time. It is useful to protect your PC, Laptop and mobile etc.
    Webroot Antivirus Support Number
    Quickbooks Payroll Support
    Quicken Tech Support Number
    Gmail Technical Support Number
    Turbo Tax Tech Support Number

    ReplyDelete
  18. Your post is really awesome. Your blog is really helpful for me to develop my skills in a right way. Thanks for sharing this unique information with us.
    - Learn Digital Academy

    ReplyDelete
  19. Thanks for the good words! Really appreciated. Great post. I’ve been commenting a lot on a few blogs recently, but I hadn’t thought about my approach until you brought it up. 
    Best Devops training in sholinganallur
    Devops training in velachery
    Devops training in annanagar
    Devops training in tambaram

    ReplyDelete
  20. Hello there! This is my first comment here, so I just wanted to give a quick shout out and say I genuinely enjoy reading your articles.
    iosh safety course in chennai

    ReplyDelete
  21. Superb. I really enjoyed very much with this article here. Really it is an amazing article I had ever read. I hope it will help a lot for all. Thank you so much for this amazing posts and please keep update like this excellent article.thank you for sharing such a great blog with us. expecting for your.
    German Classes in Chennai
    Big Data Training in Chennai
    Android Training in Chennai
    Selenium Training in Chennai
    Digital Marketing Training in Chennai
    JAVA Training in Chennai
    PHP Training in Chennai
    PHP Training Institute in Chennai

    ReplyDelete
  22. It's interesting that many of the bloggers to helped clarify a few things for me as well as giving.Most of ideas can be nice content.The people to give them a good shake to get your point and across the command
    rpa training in bangalore
    best rpa training in bangalore
    rpa training in pune

    ReplyDelete
  23. I found your blog while searching for the updates, I am happy to be here. Very useful content and also easily understandable providing.. Believe me I did wrote an post about tutorials for beginners with reference of your blog. 
    Power bi training in Chennai

    ReplyDelete

  24. This is quite educational arrange. It has famous breeding about what I rarity to vouch. Colossal proverb. This trumpet is a famous tone to nab to troths. Congratulations on a career well achieved. This arrange is synchronous s informative impolite festivity to pity. I appreciated what you ok extremely here.
    Data Science training in rajaji nagar
    Data Science with Python training in chennai
    Data Science training in electronic city
    Data Science training in USA
    Data science training in pune
    Data science training in bangalore

    ReplyDelete
  25. Thanks for posting useful information.You have provided an nice article, Thank you very much for this one. And i hope this will be useful for many people.. and i am waiting for your next post keep on updating these kinds of knowledgeable things...Really it was an awesome article...very interesting to read..please sharing like this information......
    mobile service centre
    mobile service center in chennai
    mobile service center chennai
    mobile service centre near me
    mobile service centre chennai
    best mobile service center in chennai
    best mobile service center in chennai
    mobile service center in velacherry
    mobile service center in vadapalani
    mobile service center in porur
    best mobile service center

    ReplyDelete
  26. Thanks for posting useful information.You have provided an nice article, Thank you very much for this one. And i hope this will be useful for many people.. and i am waiting for your next post keep on updating these kinds of knowledgeable things...Really it was an awesome article...very interesting to read..please sharing like this information......
    samsung mobile service center in chennai
    samsung mobile service center
    samsung mobile service chennai
    samsung mobile repair
    samsung mobile service center near me
    samsung service centres in chennai

    ReplyDelete
  27. Great post. I was once checking constantly this weblog and I'm impressed! Extremely useful information specially the closing part. I maintain such information much. I was once seeking this specific information for a very long time. Many thanks and best of luck.
    honor service centre chennai
    honor service centre
    honor mobile service center in chennai
    honor mobile service center
    honor mobile service centre in Chennai
    honor service center near me

    ReplyDelete
  28. Hey, Your post is very informative and helpful for us.
    In fact i am looking this type of article from some days.
    Thanks a lot to share this informative article.
    QuickBooks Training in Hyderabad

    ReplyDelete
  29. Amazing Post, Thank you for sharing this post really this is awesome and very useful.

    Cheers!

    WhatsApp Group Join Link List

    ReplyDelete

  30. Nice Article… I love to read your articles because your writing style is too good, its is very very helpful for all of us and I never get bored while reading your article because, they are becomes a more and more interesting from the starting lines until the end.

    best hadoop training in chennai
    hadoop big data training in chennai
    best institute for big data in chennai
    big data course fees in chennai

    ReplyDelete
  31. This is the exact information I am been searching for, Thanks for sharing the required infos with the clear update and required points. To appreciate this I like to share some useful information regarding Microsoft Azure which is latest and newest,

    Regards,
    Ramya

    Azure Training in Chennai
    Azure Training Center in Chennai
    Best Azure Training in Chennai
    Azure Devops Training in Chenna
    Azure Training Institute in Chennai
    Azure Training in Chennai OMR
    Azure Training in Chennai Velachery
    Azure Online Training
    Azure Training in Chennai Credo Systemz
    DevOps Training in Chennai Credo Systemz

    ReplyDelete
  32. This is the exact information I am been searching for, Thanks for sharing the required info with the clear update and required points. To appreciate this I like to share some useful information regarding This Topic which is the latest and newest for me.

    Regards,

    Whatsapp Group Links List

    ReplyDelete
  33. It’s interesting content and Great work. Definitely, it will be helpful for others. I would like to follow your blog. Keep post
    Check out:
    best hadoop training in omr
    hadoop training in sholinganallur
    best institute for big data in chennai
    big data hadoop course in chennai with placement

    ReplyDelete
  34. Thanks for sharing such a wonderful blog on Machine learning.This blog contains so much data about Machine learning ,like if anyone who is searching for the Machine learning data will easily grab the knowledge of Machine learning from this .Requested you to please keep sharing these type of useful content so that other can get benefit from your shared content.
    Thanks and Regards,
    Top institutes for machine learning in chennai
    best machine learning institute in chennai
    artificial intelligence and machine learning course in chennai

    ReplyDelete
  35. Let's share the most impotant Eid Mubarak Greetings to our friends...

    ReplyDelete
  36. if you are searching for free unlimted tricks then visit now on Uvoffer.com and get unlimited offers and informations.
    film ka naam whatsapp puzzle answer film ka naam whatsapp puzzle

    ReplyDelete
  37. if you want girls mobile numbers then this website is best for you . you can visit on this website and get their information and you also can meet with thrm and go for a date . click here to use our website --- online dating website

    ReplyDelete
  38. many peoples want to join random whatsapp groups . as per your demand we are ready to serve you whatsapp group links . On this website you can join unlimited groups . click and get unlimited whatsapp group links

    ReplyDelete
  39. Happy fathers day wishes is here. Just copy and send it to your father...

    ReplyDelete

  40. Selenium Training in Chennai Searching for Best Selenium Training in Chennai ?.BITA Academy is the Best Selenium Training Institute in Chennai.. Our Selenium testing course is taught by Experts.Become a Selenium Certified Professional.

    ReplyDelete
  41. amazing blog layout! How long have you been blogging for? Join Free Indian Whatsapp Group Links Latest 2019 you make blogging look easy.

    ReplyDelete
  42. Really helpful post. thanks for sharing this type of information with us. i really appreciated this information. Checkout Best and Cool Whatsapp Group Names
    Checkout Whatsapp Group Names 2019

    ReplyDelete
  43. Fascinating, this could not be written better. Please Keep up the good work.

    Thank you,

    Python training in kalyan nagar

    ReplyDelete
  44. Nice post it is very helpful for me I have some important information in your blog its very helpful for me.
    One Plus Two Service Center in Chennai


    ReplyDelete
  45. Appericated the efforts you put in the content of DevOps .The Content provided by you for DevOps is up to date and its explained in very detailed for DevOps like even beginers can able to catch.Requesting you to please keep updating the content on regular basis so the peoples who follwing this content for DevOps can easily gets the updated data.
    Thanks and regards,
    DevOps training in Chennai
    DevOps course in chennai with placement
    DevOps certification in chennai
    DevOps course in Omr

    ReplyDelete
  46. I think things like this are really interesting. I absolutely love to find unique places like this. It really looks super creepy though!!

    Check out : hadoop certification in chennai | hadoop training institute in chennai with placement | best bigdata hadoop training in chennai

    ReplyDelete
  47. ok i will care it thanks for the awesome article
    affiliategoldcoin.com
    moneytoearnit.com

    ReplyDelete


  48. Nice Blog, When i was read this blog i learnt new things & its truly have well stuff related to developing technology, Thank you for sharing this blog.
    iPhone app training course in bangalore
    Mobile app training institutes bangalore
    iPhone job oriented course in bangalore
    iPhone training classes in bangalore

    ReplyDelete
  49. This comment has been removed by the author.

    ReplyDelete

  50. Very nice posts, this could not be written better. Do posts like this, Thank you.


    Hybrid Decentralized Crypto Exchange | Best Crypto Exchange | Beldexcoin

    ReplyDelete
  51. Thanks for sharing this information. I really Like Very Much.
    online training institute

    ReplyDelete
  52. Attend The Python Training in Hyderabad From ExcelR. Practical Python Training Sessions With Assured Placement Support From Experienced Faculty. ExcelR Offers The Python Training in Hyderabad.
    python training in bangalore

    ReplyDelete
  53. Go Health Science is a best resource to get all kinds of Knowledge about Health and Science updates on Healthy Life ideas.

    ReplyDelete
  54. h3ncash adalah agen Sbobet Mobile menjadi situs taruhan bola online ter besar yang memiliki banyak pemain di dalam nya dan telah menikmati fasilitas yang ada. Selain itu sbobet mobile juga menyedia kan permainan lain Casino, Slot, atau poker.

    ReplyDelete
  55. pokerblibli adalah salah satu poker online yang paling diminati saat ini, selain banyak bonus yang bisa di dapat. ayo tunggu apalagi, bergabunglah dengan poker online blibli

    ReplyDelete
  56. Agen Sbobet dan Agen Maxbet h3ncash Situs judi yang mempunyai banyak pemain dan situs judi online terbesar diindonesia. dengan pelayanan dan keramahan agen yang berkualitas.

    ReplyDelete
  57. h3ncash adalah situs yang akan memberikan anda sebuah permainan Judi Sbobet yang terbaik dan terpercaya tentunya. Sesuai dengan visi misi yang selalu mengembangkan internal kami. Untuk meningkatkan inovasi dalam memberikan yang terbaik di antara yang terbaik bagi para petaruh judi di Indonesia.

    ReplyDelete
  58. Attend The Python training in bangalore From ExcelR. Practical Python training in bangalore Sessions With Assured Placement Support From Experienced Faculty. ExcelR Offers The Python training in bangalore.
    python training in bangalore

    ReplyDelete


  59. Get the most advanced RPA Course by RPA Professional expert. Just attend a FREE Demo session about how the RPA Tools get work.

    For further details call us @ 9884412301 | 9600112302
    RPA training in chennai | UiPath training in chennai

    ReplyDelete
  60. This blog aware me about different programs which can become very useful for our friends and kids. Few websites provide combined courses and few of the are separately for single subject. Glad to get this information.
    ศูนย์บริการรถยก

    ReplyDelete
  61. It’s interesting content and Great work. Definitely, it will be helpful for others. I would like to follow your blog. Keep post

    Check out:
    Selenium training courses in chennai
    Selenium training center in chennai
    Selenium training in chennai quora
    Selenium course fees in chennai

    ReplyDelete
  62. Thanks for sharing Information to us. If someone wants to know about,I think this is the right place for you!

    mobile app development in coimbatore
    mobile app development company in atlanta
    chatbot development company

    ReplyDelete
  63. https://www.excelr.com/python-training-in-pune

    ReplyDelete
  64. This comment has been removed by the author.

    ReplyDelete



  65. I had went throung your blog its really intersting and holds an informative content. Thanks for uploading such an wonderfull blog.
    python classes near Bellandur|python classes in Marathahalli
    selenium testing classes in Bangalore|selenium testing classes near Bellandur

    ReplyDelete

  66. ishop.global is providing Amazon products delivery services in Pakistan at very cheap rates we are same as Amazon Pakistan Now you can buy any product from Aliexpress ebay amazon and All other USA websites via ishop.global. https://ishop.global/

    online shopping
    online shopping in pakistan
    amazon online shopping
    amazon online shopping in pakistan
    amazon pakistan

    ReplyDelete
  67. Global Shopaholics is a Package forwarding company based in Delaware USA. We are proud to offer the cheapest International shipping rates from the USA to anywhere in the world to your Doorstep. Global Shopaholics core value is based on excellent customer experience while shopping internationally. Our main goal is to make international shopping shipping experience smooth, economical and easy. For more information keep visiting our website: globalshopaholics.com

    shop and ship
    myus
    viabox

    ReplyDelete
  68. Thank you for excellent article.You made an article that is interesting.
    Tavera car for rent in chennai|Indica car for rent in chennai|innova car for rent in chennai|mini bus for rent in chennai|tempo traveller for rent in chennai
    Keep on the good work and write more article like this...
    indica car rental in chennai for outstation
    Great work !!!!Congratulations for this blog


    ReplyDelete

  69. Online Review MarketTeaches You The best Seo,Blogging,Make Money Online,Girl Whatsapp Group Join,Mobile Review,Link Building Tips and Tricks For Free


    100+Hot Girl Whatsapp Group Join Link

    Xiaomi Mi Band 4 Features Price and Specification



    ReplyDelete
  70. This comment has been removed by the author.

    ReplyDelete
  71. This comment has been removed by the author.

    ReplyDelete
  72. I appreciate this informative article for the student who seeking help in the essay writing. We also provide same there you may have the best online essay writing service with the largest database of writers. here: www.5staressays.com
    Write my essay

    ReplyDelete
  73. Awesome Content. Thanks for sharing this with us.

    ReplyDelete
  74. Hello, I read your blog occasionally, and I own a similar one, and I was just wondering if you get a lot of spam remarks? If so how do you stop it, any plugin or anything you can advise? I get so much lately it’s driving me insane, so any assistance is very much appreciated.
    Data science Course Training in Chennai |Best Data Science Training Institute in Chennai
    RPA Course Training in Chennai |Best RPA Training Institute in Chennai
    AWS Course Training in Chennai |Best AWS Training Institute in Chennai
    Devops Course Training in Chennai |Best Devops Training Institute in Chennai

    ReplyDelete
  75. Just seen your Article, it amazed me and surpised me with god thoughts that eveyone will benefit from it. It is really a very informative post for all those budding entreprenuers planning to take advantage of post for business expansions. You always share such a wonderful articlewhich helps us to gain knowledge .Thanks for sharing such a wonderful article, It will be deinitely helpful and fruitful article.
    Thanks
    DedicatedHosting4u.com

    ReplyDelete
  76. Just seen your Article, it amazed me and surpised me with god thoughts that eveyone will benefit from it. It is really a very informative post for all those budding entreprenuers planning to take advantage of post for business expansions. You always share such a wonderful articlewhich helps us to gain knowledge .Thanks for sharing such a wonderful article, It will be deinitely helpful and fruitful article.
    Thanks
    DedicatedHosting4u.com

    ReplyDelete
  77. Chauffeur service London, offering executive chauffeur driven car hire services London's largest executive company. Be ready to expect more Services Chauffeur service specializing in London. Visit Here: https://www.smartcityprestige.com/
    E Class Chauffeur

    ReplyDelete
  78. Beautiful tutorial. Thank you for sharing, I went through your blog, it helped me a lot and I also received some new information.
    data science classes near bangalore|
    data science training in marathahalli|
    hadoop classes near bellandur|
    hadoop courses in kalyan nagar

    ReplyDelete
  79. Thanks for the amazing post which is really useful and more informative both in manually and technically. To handle the products. There are some best service centers.
    Redmi Service Center in Chennai
    Oneplus Service Center in Chennai

    ReplyDelete
  80. Photo Background Editor plays a key role in removing the background of the photo. The editor needs to remain highly careful while removing the background. The service is an essential one for the online business community.

    ReplyDelete
  81. Thanks for Sharing this useful information. Get sharepoint apps development from veelead solutions

    ReplyDelete
  82. It’s not dull when you write about it.. Out of every blog on this, yours worth following. Majhi naukri

    ReplyDelete
  83. Adsense is an advertising program managed by Google. It's a revolutionary way to drive traffic to a website and is considered one of the most powerful tools in an arsenal of publishers. Google Buy google adsense accounts has played a particularly important role in providing advertising revenue to small websites that do not have the resources to develop ad sales programs and sellers.

    Many sites use Best Google Adsense Seller to monetize their content and some webmasters are striving to maximize their revenue. Buy pin verified adsense accounts revenue is generated when a visitor clicks on an ad you have seen. When the user clicks on the image, they are redirected to the advertiser's site in the same manner as regular Buy Google Adsense Account ads.

    All Buy Google Adsense Account revenue comes from the AdWords program, which in turn contains a complex pricing model based on the second-tier Vickrey auction, because an advertiser is required to submit a sealed offer (invisible to competitors). ). You can combine it with affiliate products, for example by selling two of your products and paying for blogging carts, and yes, $ 500 - $ 1,000 a week possible.

    Content of the site

    Google Buy pin verified adsense accounts for mobile devices opens the possibilities of the mobile advertising market. As part of its ongoing effort to develop new ways for users to find the information they need anytime, anywhere, Google today announced the availability of Buy Google Adsense Account for Mobile, a content ad targeting the contents. From mobile sites. Just like the traditional Buy Adsense Accounts program, this will add ads to the content of your mobile website. The system automatically reviews the content of mobile publishers' websites and publishes text ads that are relevant to the public and the content of the website. "With this program, advertisers can communicate with the growing number of mobile publishers who offer users an advanced mobile experience that helps them find what they're looking for faster and more efficiently, anywhere." Google, as announced yesterday for Buy Google Adsense Account for mobile devices, a program that places ads in the content of a mobile website.

    ReplyDelete
  84. Download and install Vidmate App which is the best HD video downloader software available for Android. Get free latest HD movies, songs, and your favorite TV shows.

    ReplyDelete
  85. Great Article. This Blog Contain Good information about ERP Software. Thanks For sharing this blog. Can you please do more articles like this blog.


    machine maintenance software price in us
    machine maintenance software development in us
    crm software development cost in us
    erp in chennai
    crm software development cost in chennai
    cloud erp in chennai

    ReplyDelete
  86. Really nice and interesting post. I was looking for this kind of information and enjoyed reading this one. Keep posting. Thanks for sharing.
    One Machine Learning
    One data science
    Bissi.Global

    ReplyDelete
  87. Thank you for providing the valuable information …

    If you want to connect with AI (Artificial Intelligence) World
    as like
    Python Training
    ML(Machine Learning)

    Course related more information then meet on EmergenTeck Training Institute .

    Thank you.!

    ReplyDelete