# How I managed to get an @Google.com email address, bypassing their previous patch!

Buganizer issue-tracker email replies reflected verification codes, letting a researcher verify and sign up a Google account using a buganizer-system+...@google.com address.

- Payout: $3,134
- Severity: medium
- Program: Google
- Credited: Gopal Singh
- Disclosed: 2018-12-01
- Write-up quality: 6/10
- Original: https://www.andmp.com/2018/12/how-i-managed-to-get-google.html
- Library page: https://bugbountylibrary.com/r/blog%3Aandmp-com-2018-12-how-i-managed-to-get-google-html
- Tags: domain:web impact:ato kind:bounty platform:blog sev:medium tech:email technique:incomplete-fix vuln:auth-bypass vuln:info-disclosure vuln:misconfiguration

**Target:** Buganizer issue tracker email-to-comment pipeline and Google account signup
**Root cause:** Emails sent to buganizer-system+componentID+issueID@google.com are posted as comments in the public issue tracker, so any verification code sent to that address is reflected back to the attacker-controlled issue thread.
**Steps:**
1. Email `buganizer-system+190923@google.com` to file an issue in the Android public tracker; note confirmation from `buganizer-system+<email>@google.com`.
2. Reply to the confirmation email; the reply is posted as a comment in the issue conversation.
3. In Gmail settings > Forwarding, add `bug...@google.com` as forwarding address to trigger a verification code.
4. Observe the verification code appears as a comment in the public issue tracker.
5. Find a Google signup page accepting @google.com addresses, sign up with the buganizer address, and read the verification code from the issue thread.
**How found:** Read Alex Birsan's prior writeup on the issue tracker, hypothesized email replies are reflected as comments, then tested by triggering a Gmail forwarding verification code to the buganizer alias.
**Exploitation:** Attacker controls an issue thread via email; any mail sent to the buganizer-system+...@google.com alias is echoed as a comment, leaking verification codes for account signup/verification.
**Escalation:** Bypassed Google's prior fix for the same email-reflection issue (regression) to complete full account signup and verification.
**Insight:** Email-to-ticket gateways that post inbound mail as public comments will reflect any verification code sent to the alias; test account signup/verification flows against such aliases, and re-test after patches since fixes are often incomplete.