# admin.google.com Reflected Cross-Site Scripting (XSS)

Unvalidated continue parameter on admin.google.com ServiceNotAllowed page accepted javascript: URLs, letting an attacker execute script as a Google Apps admin.

- Payout: unconfirmed
- Severity: high
- Program: Google
- Credited: Brett Buerhaus
- Disclosed: 2015-01-21
- Write-up quality: 6/10
- Original: https://buer.haus/2015/01/21/admin-google-com-reflected-cross-site-scripting-xss/
- Library page: https://bugbountylibrary.com/r/blog%3Abuer-haus-2015-01-21-admin-google-com-reflected-cross-site-scripting-xss
- Tags: domain:web impact:ato impact:privesc kind:bounty platform:blog sev:high technique:source-review vuln:open-redirect vuln:xss

**Target:** admin.google.com ServiceNotAllowed page continue parameter
**Root cause:** The continue request parameter was reflected into a JavaScript redirect (window.location.href) without validating the URL scheme, allowing javascript: URIs to execute.
**Steps:**
1. Log into at least two Google accounts.
2. Visit `https://admin.google.com/mrzioto.com/ServiceNotAllowed?service=grandcentral&continue=javascript:alert(document.cookie);//`
3. Select an account radio button; onContinueClick sets window.location.href to the continue value, executing the javascript: payload.
**How found:** Researcher targeted sensitive Google services and audited the common continue parameter across the login flow, finding ServiceNotAllowed was the only page that failed to validate the URL passed into its JavaScript redirect.
**Exploitation:** Attacker crafts the ServiceNotAllowed URL with a javascript: continue payload and sends it to a Google Apps admin; when the admin selects an account, the script runs in admin.google.com origin, allowing forced requests to create super admins, disable 2FA, redirect domain DNS/mail, or reset passwords.
**Escalation:** Chained XSS with admin console actions to create super admin users, disable 2FA, hijack accounts, and redirect domain email.
**Insight:** The continue/redirect parameter is reused across many auth-flow pages; enumerate every page that consumes it and test scheme handling (javascript:, data:) rather than just open-redirect targets, since one unvalidated consumer yields same-origin XSS.