Writeups

XSS in Firebase Studio (Awarded $7500, Deprecated)

URL: https://studio.firebase.google.com/

Details

https://firebase-<ID>.cloudworkstations.dev/vscode-remote-resource?path=%2Fephemeral%2Fnix%2Fstore%2F0gipi1c293rqpfs1bs4fmncipayc07f8-android-sdk-build-tools-33.0.1%2Flibexec%2Fandroid-sdk%2Ftools%2Fproguard%2Fdocs%2Findex.html#javascript:alert(origin)

Attack scenario

Attacker gets XSS on https://firebase-<ID>.cloudworkstations.dev that is the main IDE origin for Firebase Studio (aka Project IDX)

Insecure code is found in /ephemeral/nix/store/0gipi1c293rqpfs1bs4fmncipayc07f8-android-sdk-build-tools-33.0.1/libexec/android-sdk/tools/proguard/docs/index.html but I think vscode-remote-resource needs to stop rendering HTML or be sandboxed to prevent similar attacks.

var main = 'main.html';
if (window.location.hash.length > 1) main = window.location.hash.substr(1);
var sections = 'sections.html';
if (main.search(/manual\//) >= 0) sections = 'manual/sections.html';

document.write(
  '<frameset rows="50,*" framespacing="0" frameborder="no"><frame id="title" name="title" src="title.html" scrolling="no" marginwidth="0" marginheight="0" noresize /><frameset cols="120,*" framespacing="0" frameborder="no"><frame id="sections" name="sections" src="' +
    sections +
    '" scrolling="no" marginwidth="0" marginheight="0" noresize /><frame id="main" name="main" src="' +
    main +
    '" scrolling="auto" marginwidth="10" marginheight="10" noresize /></frameset></frameset>'
);

XSS on ip.dev.gss.google (Awarded $200)

URL: https://ip.dev.gss.google/request?x%27%22%3E%3Cscript%3Ealert(origin)%3C/script%3E

Details

Go to https://ip.dev.gss.google/request?x%27%22%3E%3Cscript%3Ealert(origin)%3C/script%3E
See there’s an reflected XSS with some Werkzeug/3.0.1 debugger information exposed.

Attack scenario

A nice security feature of google and withgoogle.com is there on the PSL https://publicsuffix.org/list/public_suffix_list.dat however with this XSS browser provided site isolation protections like process isolation, cache partitioning and cookies are bypassed for *.gss.google that includes https://idp.gss.google/admin/ and https://idp.dev.gss.google/admin/ which are sensitive “Identity and Access Management” services.

For context this is the disclaimer used on https://idp.dev.gss.google/realms/dev/protocol/saml/clients/google:

“This Google environment (including this Workspace environment and any third-party sites, applications, or domains accessed through this system) is provided for authorized business use only.

This system contains sensitive information, including Controlled Unclassified Information (CUI) with specific safeguarding requirements imposed by the Department of Defense. Use of this system may also be subject to requirements for other data types, such as Export Controlled information. System usage may be monitored, recorded, and is subject to audit. Unauthorized use of this information system is prohibited and may be subject to legal penalties. Your use of this information system, authorized or unauthorized, constitutes consent to this monitoring and recording. The Google Public Sector Data Handling Policy is in effect, and can be read on the google.com domain. For more information regarding use and monitoring of Google corporate systems and services generally, see Google’s Corporate Systems Monitoring Policy and Corporate Services Security Policy in the google.com domain. If you cannot access google.com Drive, these policies can be provided upon request.”

This domain was found in the certificate logs of https://crt.sh/?q=gss.google and fixed by the removal of https://ip.dev.gss.google/

Antigravity IDE secure mode bypass

URL: https://antigravity.google/

Vulnerability type: Remote Code Execution (RCE)

Details

Copy my config to .vscode/tasks.json
{
  "version": "2.0.0",
  "tasks": [
    {
      "label": "Run on Open",
      "type": "shell",
      "command": "start notepad",
      "presentation": {
        "reveal": "always",
        "panel": "new"
      },
      "runOptions": {
        "runOn": "folderOpen"
      }
    }
  ]
}

Attack scenario

Users are vulnerable to prompt injection -> RCE attacks even while doing safe activity like researching and web design with the browser tool.

Since agents can modify the .vscode folder of a trusted workspaces without a prompt (Chat does not load if its not trusted)

This version requires an IDE reload but that might not be needed as the pre-installed php-language-features allows for running a no arguments program via .vscode/settings.json without reload there will likely be commonly installed extensions that work. I think you can also change the starting command when a terminal is opened in the same folder.

When https://antigravity.google/docs/secure-mode is enabled the AI agent should not be able to run code without prompting as per https://bughunters.google.com/learn/invalid-reports/google-products/4655949258227712/antigravity-known-issues “if Terminal -> Auto Execution Policy is Off please file a report”

The VSCode agent has a protection for this attack:

Allow edits to sensitive files?
The model wants to edit sensitive files (tasks.json). Do you want to allow this?

https://code.visualstudio.com/updates/v1_104#_confirm-edits-to-sensitive-files

You can also bypass gitignore protection “Allow Agent to view and edit the files in .gitignore. Use with caution if your .gitignore lists files containing credentials, secrets, or other sensitive information.” by asking the LLM

Gmail receiver spoof (Awarded $500, WAI)

Summary: Gmail receiver spoof

URL: https://play.google.com/store/apps/details?id=com.google.android.gm

Vulnerability type: Security UI Spoofing

Details

Vulnerability Description The Google Sans font ligatures can be used to spoof where an email is sent to (Android Gmail app). And probably sent by but that’s getting into email spoofing.

Attack Preconditions

The attacker needs to trick the victim into tapping a web link or text message.

Reproduction Steps / POC

<a href="mailto:support@googllogoligaturee.com?subject=Support">Support</a>

Notice the email is getting sent to what appears visually to be support@google.com but once the email is sent it goes to an unregistered domain.

This is similar to the chromium issue: https://issuetracker.google.com/391788835 googlelogoligature ligature can disguise security-sensitive surfaces

Attack scenario

In its current state you can trick the victim into thinking they’re emailing @google.com via the Android Gmail app when they’re not.

Improve this page