{"id":95,"date":"2013-08-30T11:19:51","date_gmt":"2013-08-30T11:19:51","guid":{"rendered":"https:\/\/www.varutra.com\/blog\/?p=95"},"modified":"2022-12-02T17:13:22","modified_gmt":"2022-12-02T11:43:22","slug":"insecure-url-redirection-in-google","status":"publish","type":"post","link":"https:\/\/www.varutra.com\/varutravrt3\/insecure-url-redirection-in-google\/","title":{"rendered":"Insecure URL redirection in Google+"},"content":{"rendered":"


\n\"Insecure<\/a><\/p>\n

Our team identified a vulnerability in Google+ (Google Plus) service which can be used to perform malicious insecure URL redirection in google+. It was possible to bypass the Google+ ‘Redirect Notice’ and divert user to a malicious site.\u00a0 The issue takes advantage of Google+ facility to redirect users from Google service to third party sites.<\/p>\n

When User is redirecting to a third party site(s), Google+ shows a Redirect Notice that the user is about to be re-directed and thus user can make a choice of either continuing with re-direction or stay with Google+.<\/p>\n

Varutra team could successfully bypass the redirect notice and came up with a way to directly divert the users to third party site(s) without any notice or correspondence from Google+. The severity of the identified threat is raised by the fact that the victim user need not be logged in to the Google+ account.<\/p>\n

Below are the steps to reproduce the issue:<\/p>\n

I. Please note, these steps are just to showcase the consequence of the vulnerability and are given for educating users about the threats, Varutra does not hold any responsibility for use\/misuse of this information.<\/p>\n

II. Attacker navigates to page http:\/\/plus.url.google.com\/url?q= and enters the malicious URL of choice. (http:\/\/plus.url.google.com\/url?q=http:\/\/www.malicious-site.com)<\/p>\n

III. Google+ generates a redirection request\/URL ands show a Redirect Notice with two options;<\/p>\n

    \n
  1. \n
      \n
    1. The previous page is sending you to http:\/\/www.malicious-site.com<\/li>\n
    2. \u00a0If you do not want to visit that page, you can return to the previous page.<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n

      IV. The redirection URL will look like http:\/\/plus.url.google.com\/url?q=http:\/\/www.malicious-site.com&ei=Fw0WUoPPGcvwrQfwqIFI&sa=X&ct=targetlink&ust=1377178655421471&usg=AFQjCNHfnI0h_f5_uqegvYZ
      \nHaX3pPOQQ6Q<\/p>\n

      V. Attacker right clicks on the www.malicious-site.com and copy link location<\/p>\n

      VI. This link then can be sent to victim user through numerous and best suited ways to redirect him\/her to the http:\/\/www.malicious-site.com without any notice from Google+<\/p>\n

      The only thing to notice is that this link is temporary and valid for approximately 30 minutes.<\/p>\n

      It was also observed that other Google services such as google.com (search engine) and orkut.com are also open to this issue.<\/p>\n

      Written By,<\/p>\n

      Attack & PenTest Team,<\/em><\/p>\n

      Varutra Consulting<\/em><\/p>","protected":false},"excerpt":{"rendered":"

      Our team identified a vulnerability in Google+ (Google Plus) service which can be used to perform malicious insecure URL redirection in google+. It was possible…<\/p>\n","protected":false},"author":3,"featured_media":3201,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"inline_featured_image":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[259,140,261,266,267,57],"tags":[],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t