Summary
GCP Cloudshell has been affected by various XSS and CSRF vulnerabilities stemming from different root causes
related to authentication handling, markdown editing, file uploading and more. Explotiation of these vulnerabilities
normally requires user interaction through social engineering (convincing a potential victim to click a malicious link).
Affected Services
GCP Cloudshell
Remediation
null
Tracked CVEs
No tracked CVEs
References
https://obmiblog.blogspot.com/2022/12/gcp-2022-few-bugs-in-google-cloud-shell.htmlhttps://obmiblog.blogspot.com/2019/12/gcp-5k-file-uploading-csrf.htmlhttps://obmiblog.blogspot.com/2019/12/gcp-5k-oauth-token-hijack.htmlhttps://obmiblog.blogspot.com/2019/12/gcp-5k-xss-type-ii.htmlhttps://security.googleblog.com/2023/06/google-cloud-awards-313337-in-2022-vrp.html
Contributed by https://github.com/mer-b
Entry Status
Finalized
Disclosure Date
-
Exploitablity Period
-
Known ITW Exploitation
-
Detection Methods
-
Piercing Index Rating
-
Discovered by
Obmi
