# Multiple Authorization bypass issues in Google's Richmedia Studio

Multiple authorization flaws in Google Richmedia Studio let any user read other advertisers' uploaded media and all campaigns via guessable IDs and a fail-to-true permission bug.

- Payout: $6,000
- Severity: high
- Program: Google
- Credited: Zohar Shachar
- Disclosed: 2021-03-24
- Write-up quality: 6/10
- Original: https://www.ehpus.com/post/multiple-authorization-bypass-issues-in-google-s-richmedia-studio
- Library page: https://bugbountylibrary.com/r/blog%3Aehpus-com-post-multiple-authorization-bypass-issues-in-google-s-richmedia-studio
- Tags: domain:web impact:data-leak impact:internal-access kind:bounty platform:blog sev:high tech:rest technique:recon technique:source-review vuln:access-control vuln:auth-bypass vuln:idor

**Target:** Marketing campaign management web app (GWT RPC API, s0.2mdn.net media host)
**Root cause:** Media served from unauthenticated s0.2mdn.net with guessable merchant-ID/date paths; GWT download-URL requests trust short client-supplied campaign IDs without ownership checks; a permission check fails open so a user with no QA permission sees all campaigns.
**Steps:**
1. Upload media; observe preview link `https://s0.2mdn.net/preview/<long>/ads/richmedia/studio/<merchantId>/...`
2. Inspect network responses to find direct link `http://s0.2mdn.net/ads/richmedia/studio/pv2/<merchantId>/<date>/<file>`
3. Enumerate merchant IDs (8 digits) and dates to fetch other users' files unauthenticated
4. Create limited account without QA dashboard permission; navigate directly to QA page URL
5. Observe all campaigns of all accounts are listed (fail-to-true)
6. Capture GWT POST body with trailing campaign IDs `DlQXE|DlQWU`; swap IDs from another account while keeping own cookies
7. Brute-force short IDs to retrieve download URLs for other users' files
**How found:** Noticed media hosted on non-Google s0.2mdn.net (no cookies) and that the 'preview' path hinted at a simpler direct path; tried accessing QA page with a permissionless account expecting denial; decoded GWT RPC body and spotted short campaign IDs at the end, then swapped them across accounts.
**Exploitation:** Attacker with any studio account enumerates merchant IDs and short GWT campaign IDs, then requests download URLs with their own session cookies to obtain other advertisers' media and campaign data; limited accounts reach the QA dashboard directly to view every campaign.
**Escalation:** Chained IDOR on media host with GWT ID substitution and fail-open permission to broaden from single-file access to all campaigns across accounts.
**Insight:** When files are served from a separate cookie-less domain, look for a simpler 'direct' path leaked in a second response alongside the obfuscated preview URL; and in GWT RPC bodies, the trailing short strings are often object IDs worth swapping across sessions.