Even the giants have their Achilles heel, the Google Apps administrator console is affected by a critical cross-site scripting (XSS) vulnerability that could be exploited by attackers to force a Google Apps admins to execute request on the https://admin.google.com/ domain.
The unknown flaw was first discovered by application security engineer Brett Buerhaus that reported it to Google on September 1st. Google promptly resolved the problem and fixed the flaw within 17 days. Buerhaus received by Google $5,000 as a reward under its bug bounty program.
The Google Apps admin console is the instrument used by administrators to manage their corporate account, it allows to add new users, enable Google services the domain, configure permissions and manage security settings.
The XSS flaw allowed attackers to force the admin to do the following actions:
Buerhaus explained that if users are not authorized to use a specific service they will be presented with a “ServiceNotAllowed” page, the expert explained that this page could be exploited to switch between accounts in order to log in to the service.
“The ServiceNotAllowed page appears when you are attempting to access a Google app service that has not been configured for your domain. It requires that you are logged into at least two accounts and will give you a form to switch accounts to continue to the service you were trying to load.” said Buerhaus in a blog post.