Other nomination

Using YouTube to steal your files Ʊ

A Google Slides YouTube embed takes only a video id, but a traversal points the iframe at any page on that host. Two token-less redirects, plus a legacy hop that defeats a fetch-metadata check, frame a Docs share dialog pre-filled with the attacker's address, so one disguised click grants Editor access to a victim's Drive files.

Record

Published by

lyra's epic blog

Date

19 September 2024

In the archive

• Nominated for the 2024 Top 10 Web Hacking Techniques

Related sources

• Using YouTube to Steal Your Files slides
• BSides Tallinn talk recording
• Disobey talk recording

Tags

• clickjacking
• open-redirect
• path-traversal
• ui-redress
• iframe
• url-parsing
• sop-bypass
• attack-chain
• bug-bounty
• owasp-a01-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of lyra's epic blog, first published at the original source. Preserved copies are kept so the citation survives its host.