# $7.5k Google services mix-up

Service Management API skipped serviceName/serviceConfig.name match check on creation with crafted configVersion, letting attacker impersonate other services to enable private APIs and disable others' services.

- Payout: $7,500
- Severity: high
- Program: Google VRP
- Credited: Ezequiel Pereira
- Disclosed: 2018-02-14
- Write-up quality: 8/10
- Original: https://www.ezequiel.tech/p/75k-google-services-mix-up.html
- Library page: https://bugbountylibrary.com/r/blog%3Aezequiel-tech-p-75k-google-services-mix-up-html
- Tags: domain:api domain:cloud impact:dos impact:internal-access impact:privesc kind:bounty platform:blog sev:high technique:recon technique:source-review vuln:access-control vuln:auth-bypass vuln:business-logic vuln:misconfiguration

**Target:** Google Service Management API (servicemanagement.clients6.google.com)
**Root cause:** On service creation, the backend failed to enforce that serviceName equals serviceConfig.name when configVersion was 1, 2, or in the integer-overflow range 2147483648-4294967295; downstream processes used the config name for actions but the real name for permission checks.
**Steps:**
1. Obtain Google Cloud Console client API key `AIzaSyCI-zsRP85UVOi0DjtiCwWBwQ1djDy741g` and SAPISIDHASH auth from console traffic
2. POST `/v1/services?key=...` with `serviceName` set to a real target service and `serviceConfig.name` set to a different service, `configVersion` set to 1, 2, or 2147483648-4294967295
3. Enable the crafted service on a project to actually enable the impersonated service
4. PATCH `/v1/services/<own>/projectSettings/<project>?updateMask=visibilitySettings` with `visibilityLabels:["TRUSTED_TESTER"]` to unlock hidden capabilities
5. PATCH `...?updateMask=usageSettings` with `consumerEnableStatus:"DISABLED"` to disable a service on another project (e.g. google.com:cloudsdktool)
**How found:** Inspected Cloud Console HTTP traffic to discover the privileged clients6 client and its API key; enumerated hidden methods/params via the API filter combo box; noticed hidden `serviceConfig` param on service creation and probed configVersion values, finding the name-match check bypassed at 1, 2, and overflow range.
**Exploitation:** Attacker with any Google account forges requests using the Console's privileged client (API key + SAPISIDHASH + cookies), creates a service whose config name points at a victim service, then uses projectSettings PATCH to enable private APIs, grant visibility labels, or disable services on arbitrary projects.
**Escalation:** Chained impersonation to enable private/in-development Google APIs, bypass billing and quota enforcement, and disable critical APIs on other projects causing outages.
**Insight:** Hidden parameters on privileged first-party clients are reachable by replaying the console's own API key + SAPISIDHASH; fuzz numeric version/type fields for integer-overflow bypasses of validation checks that gate cross-object identity.