# 2 CSRF 1 IDOR on Google Marketing Platform

Google Marketing Platform partner listing edit endpoint lacked CSRF token and trusted a user-supplied ID, allowing IDOR and CSRF to overwrite any partner profile.

- Payout: $4,134
- Severity: high
- Program: Google
- Credited: apapedulimu / Nosa Shandy
- Disclosed: 2021-09-06
- Write-up quality: 6/10
- Original: https://apapedulimu.click/story-of-idor-on-google-product/
- Library page: https://bugbountylibrary.com/r/blog%3Aapapedulimu-click-story-of-idor-on-google-product
- Tags: domain:web impact:integrity kind:bounty platform:blog sev:high tech:rest technique:source-review vuln:access-control vuln:csrf vuln:idor

**Target:** marketingplatform.google.com partner listing edit/register endpoints
**Root cause:** The save/listing endpoint accepted a user-controlled ID parameter without ownership validation (IDOR) and had no CSRF token, so cross-site POSTs with victim IDs modified arbitrary profiles.
**Steps:**
1. Register as partner at /about/partners/create-listing and open edit listing
2. Intercept the save request in Burp
3. Replace the ID parameter with a victim's company ID and delete the trailing unknown ID parameter
4. Send request; response returns [1] and victim profile is overwritten
5. For CSRF: host an HTML page that XHR POSTs to /about/partners/services/listing/save with withCredentials and the victim's public ID in the body
6. Victim visits page; profile data is replaced
**How found:** Compared requests across two accounts, noticed four differing IDs reflected in the Referer, deleted the unexplained ID parameter and observed the request still succeeded, confirming IDOR; then noticed the edit request carried no CSRF token in Burp history.
**Exploitation:** Attacker harvests victim company IDs from public partner URLs, then lures victim to a malicious page that auto-submits a credentialed POST to the save endpoint, overwriting the victim's partner listing data.
**Escalation:** Separate CSRF on /about/partners/services/become_gacp/create_company allowed overwriting a pending registration before Google review.
**Insight:** When a request contains multiple IDs, delete the ones you don't understand and resend — the server may only validate the ones it needs, revealing which parameter actually controls object ownership.