A security expert, Zohar Shachar, has reported an XSS vulnerability in Google Maps via Google’s bug reward program. With each passing day, we are getting news on hacks, security experts, and vulnerabilities. In short, these incidents are indicating that cyber threats are increasing at an alarming pace.
The issue was mainly related to the Google Maps feature, which allows the users to create their own maps. And these maps can be later exported by the user in a variety of formats KML, which is XML-based and is commonly used to display geographic data in Google Earth and other similar types of apps.
The security researcher, Zohar Shachar, discovered an open CDATA tag and XML containing while analyzing the server response when exporting a map using KML.
Apart from this, using special characters, Zohar Shachar tried to close the tag, and there he observed that by adding “]]>” at the beginning of the payload giving him access to go beyond the CDATA and inject arbitrary XML content; This eventually leads to an XSS vulnerability.
In short, using this flaw, an attacker can easily create a new map in Google Maps and equip it with an XSS payload. Then to make it public, the attacker will export it as a KML file, and copy the download link to send it to the victim to click on it, and execute the malicious code in the victim’s browser.
However, after discovering this flaw, Zohar Shachar immediately reported this bug to Google, and for reporting this bug to Google, he received $5,000 as a reward under Google’s Bug Bounty program.
But, here comes the twist, after reporting the first bug, Zohar again decided to analyze the patch implemented by Google to fix the bug that he reported. Within 10 minutes, he managed to bypass Google’s solution and cross-site scripting once again.
This time to bypass the two CDATA tags and this fix, he closed the tags twice, that’s it, and the exploit worked again. The security expert reported this flaw to Google, and once again, he received $5,000 as a reward from Google.
On April 23, Zohar reported the first XSS bug, and by April 27, Google acknowledged the vulnerability by publishing the first fix for this bug. While Zohar received his reward from Google on June 7, and on June 18, he received the second reward.
You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.
Also Read:
6 WhatsApp Vulnerabilities in Android & Desktop Versions Allows Attackers to Execute Code Remotely
Iranian Charming Kitten APT Hackers Deploying Malware via WhatsApp Messages
Hackers are actively probing AI systems, turning exposed gateways and agent tools into routes for…
Hackers are making some phishing pages harder to track by changing the code delivered to…
A cyber incident reportedly forced a British power plant to halt operations for about four…
Russian hackers have used a new backdoor called HOOKEDGE to target defense manufacturers, government bodies,…
TITAN ransomware is pairing file encryption with an ambitious claim: artificial intelligence that can sort…
A fake student resume is being used to place a remote-access tool on researchers’ Windows…