# [ GCP 2022 ] Few bugs in the google cloud shell

Three Google Cloud Shell flaws: reflected XSS via unescaped uri param, CSRF file upload to .bash_profile, and stored XSS in markdown webview enabling OAuth token theft via NEL.

- Payout: $15,000
- Severity: high
- Program: Google
- Credited: Obmi
- Disclosed: 2022-12-26
- Write-up quality: 8/10
- Original: https://obmiblog.blogspot.com/2022/12/gcp-2022-few-bugs-in-google-cloud-shell.html
- Library page: https://bugbountylibrary.com/r/blog%3Aobmiblog-blogspot-com-2022-12-gcp-2022-few-bugs-in-google-cloud-shell-html
- Tags: domain:cloud domain:web impact:ato impact:data-leak kind:bounty platform:blog sev:high tech:gcp technique:chained vuln:account-takeover vuln:csrf vuln:xss

**Target:** Cloud Shell file-upload and webview endpoints
**Root cause:** Unescaped uri param reflected as text/html; upload endpoints lack CSRF protection; webview parent trusts postMessage without origin check and injects unsanitized state into inline script.
**Steps:**
1. XSS: POST multipart to `https://<host>/file-upload` with `uri=/tmp/test<img/src/onerror=alert(document.domain)>`; response reflects payload as text/html.
2. CSRF: cross-origin POST to `/_cloudshell/file?path=` or `/file-upload` with credentials; upload to `~/.bash_profile` for persistence.
3. Stored XSS: upload HTML to `/google/devshell/editor/theia/lib/<file>.html` then navigate to it.
4. Markdown XSS: render markdown with `<meta http-equiv=refresh content='0;url=//evil'>` to redirect child frame, then `parent.parent.postMessage()` a state containing `</script><script>evil` to break out of inline script.
5. NEL: from controlled VM, serve devshell origin with NEL report-uri pointing to attacker; browser stores it and leaks OAuth tokens in 503 error reports.
**How found:** Observed unescaped uri reflected with text/html content-type; noticed upload endpoints accepted cross-origin POSTs; read webview main.js and found getVsCodeApiScript injects state into inline script and parent lacks origin check; reasoned NEL persists report-uri per origin to leak tokens.
**Exploitation:** Attacker lures victim to attacker page that auto-submits forms to victim's Cloud Shell origin; CSRF uploads persist payloads in bash_profile or webview lib dir for code exec/XSS. Markdown webview XSS plus NEL report-uri poisoning yields persistent OAuth token exfiltration on each new session.
**Escalation:** Chained CSRF upload to stored XSS in webview, then NEL report-uri hijack to permanently steal OAuth tokens across sessions.
**Insight:** NEL report-uri is stored per-origin and persists; if you can briefly control an origin (via XSS/CSRF), poison its NEL config to exfiltrate future error-report URLs containing tokens. Also check webview postMessage handlers for missing origin checks and state injected into inline scripts.