$5k bug bounty paid for Google.com XSS

Credit: Spagnuolo

Google has paid a researcher $5000 for a cross-site scripting (XSS) vulnerability in the Google domain. 

Italian computer engineer Michele Spagnuolo who received the bug bounty said the vulnerability needed no user interaction and was "due to a glitch in Google Finance" related to a JavaScript chart application (finance/f/sfe-opt.js).

"[It tricks] the JavaScript application for plotting charts to load a file hosted on an external domain and eval() its content as Javascript code," Spagnuolo said.

"This exploit does not require any user interaction, it's just a matter of clicking on a URL."

He said the vulnerability was fixed within days and offered steps to reproduce the XSS on his blog.

Cross-site scripting attacks were common and involved malicious scripts injected into web sites. They could occur whereever web applications incorporated user input in generated output without validation.

See OWASP for advice on preventing the attacks.

Copyright © SC Magazine, Australia