# XSS using postMessage in Google Cloud Theia notebooks [Google VRP]

Theia webview postMessage handler in Vertex AI Workbench allowed XSS, letting attackers steal the default compute service account token and take over the GCP project.

- Payout: $3,134
- Severity: high
- Program: Google
- Credited: Sreeram KL, Sivanesh Ashok
- Disclosed: 2023-01-15
- Write-up quality: 7/10
- Original: https://blog.geekycat.in/xss-using-postmessage-in-google-cloud-theia-notebooks/
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-geekycat-in-xss-using-postmessage-in-google-cloud-theia-notebooks
- Tags: domain:cloud impact:internal-access impact:privesc kind:bounty platform:blog sev:high tech:gcp technique:recon technique:source-review vuln:misconfiguration vuln:xss

**Target:** Theia webview extension on notebooks.googleusercontent.com subdomain
**Root cause:** Theia's webview extension accepted postMessage with channel 'content' and allowScripts:true, rendering attacker-supplied HTML/JS in the notebook origin without origin validation.
**Steps:**
1. Deploy a Vertex AI Workbench instance with Theia; note the version is outdated.
2. Identify CVE-2021-41038 applies: webview extension enabled.
3. Host attacker page that calls `w = open("https://{VICTIM-SUBDOMAIN}-dot-us-west1.notebooks.googleusercontent.com/webview/index.html?id=a")`.
4. After 5s, `w.postMessage({channel:"content", args:{options:{allowScripts:true}, contents:"<img src=x onerror=...>"}}, "*")`.
5. Victim clicks button; JS executes in notebook origin.
6. Fetch service account token from metadata server and use it against project APIs.
**How found:** Noticed Theia version was outdated during workbench deployment; Googled known CVEs, tested which still applied, found webview extension enabled and CVE-2021-41038 exploitable via postMessage.
**Exploitation:** Attacker lures victim to a page that opens the webview and posts a malicious message; JS runs in the notebook origin, reads the GCP metadata server token for the default compute service account, and uses it to control all project resources.
**Escalation:** XSS in notebook origin -> metadata token theft -> full project compromise; also any user with Notebook viewer role can read the subdomain and escalate to editor.
**Insight:** When a target embeds an outdated IDE (Theia/Cloud Shell-style), check which extensions remain enabled and test postMessage handlers with allowScripts:true; the notebook origin often has metadata-server access, turning XSS into cloud credential theft.