Last night I received an email from Nir, who wanted to share with me its great work on the 1337$ Google Reward Program he completed.
The vulnerability he found could be used by an attacker to get administrator privilege over any blogger account thanks to the HTTP Parameter Pollution vulnerability in Blogger that allows an attacker to add himself as an administrator on the victim’s blogger account.
Nir exploited a vulnerability due to the inconsistency of parameter evaluation and parameter elaboration as the volloging attack vector shows:
security_token=attackertoken&blogID=attackerblogidvalue&
blogID=victimblogidvalue&authorsList=goldshlager19test%40gmail.com
(attacker email)&ok=InviteThere are two blogid values in the post request (blogID=attackerblogidvalue&blogID=victimblogidvalue)
The server checks the first blogid value and executes the second blogid value: the attacker one.
In the same way Nir injects the memberID gaining admin privileges.
Here the great video he made.
Well, what to say now…. Thank you for sharing and for have waited my own post instead of put it by yourself ! 😉
Certified Ethical Hacker CEH training is held at TechBharat Consulting using official EC-Council curriculum. CEH certification certifies you as Ethical Hacker and Penetration Tester. CEH training is held on Version 7.
ethical hacking workshops