XSS, CSRF grants Gmail passwords

Google has fixed a security issue in its Gmail password recovery process which could leave users' passwords vulnerable to theft via social engineering.

Researcher Oren Hafif discovered the bug and demonstrated how to exploit it in a video.

Google's security team fixed the issue in 10 days.

By sending a victim a phishing email, designed to look like a password reset email from Google, an attacker could easily lead users to a malicious URL, setting the stage for exploit.

Hafif showed how a cross-site request forgery attack, followed by a cross-site scripting attack, could prompt Google to actually allow users to reset

their passwords under the watchful eyes of a saboteur.

This article originally appeared at scmagazineus.com