# Write Up – Google Bug Bounty: XSS To Cloud Shell Instance Takeover (Rce As Root) – $5,000 USD

Stored XSS in Cloud Shell markdown preview read arbitrary files via /files/ endpoints, leaking id_cloudshell SSH key to gain root on the VM.

- Payout: $5,000
- Severity: high
- Program: Google
- Credited: Omar Espino
- Disclosed: 2020-10-01
- Write-up quality: 8/10
- Original: https://omespino.com/write-up-google-bug-bounty-xss-to-cloud-shell-instance-takeover-rce-as-root-5000-usd/
- Library page: https://bugbountylibrary.com/r/blog%3Aomespino-com-write-up-google-bug-bounty-xss-to-cloud-shell-instance-takeover-rce-as-root-5000-usd
- Tags: domain:web3 impact:privesc impact:rce kind:bounty platform:blog sev:high technique:chained technique:source-review vuln:path-traversal vuln:secrets-leak vuln:xss

**Target:** Cloud Shell Theia editor markdown preview and /files/ download API
**Root cause:** Markdown preview rendered attacker HTML/JS unsandboxed in the Theia origin, and the /files/ and /files/download/ endpoints served arbitrary file:// URIs including ../ traversal to the SSH private key.
**Steps:**
1. Host attacker server (ngrok + nc) to receive exfil.
2. Create GitHub repo with readme.md containing `<style onload>` JS and an 'Open in Cloud Shell' button.
3. Victim clicks button, imports repo, previews readme.md.
4. JS calls `GET https://<host>/files/?uri=file:///../id_cloudshell` and `file:///etc/hostname`, then `GET /files/download/?id=<id>` to fetch contents.
5. POST results to attacker server.
6. Derive hostname: strip `cs-6000-`, append `.cloudshell.dev`.
7. `ssh -i id_cloudshell -p 6000 root@devshell-vm-XXXX.cloudshell.dev`.
**How found:** Searched Theia GitHub issues tagged security, found a Googler-reported markdown preview XSS with PoC, tested it on shell.cloud.google.com; then explored the Download files button traffic in DevTools to discover the /files/ and /files/download/ endpoints.
**Exploitation:** One-click import of malicious repo plus markdown preview triggers XSS; JS abuses file-serving API to read the root SSH private key and hostname, exfiltrates them, then attacker SSHes as root on port 6000.
**Escalation:** Chained XSS -> arbitrary file read -> SSH key theft -> public hostname derivation -> root SSH login on the Cloud Shell VM.
**Insight:** When a web IDE exposes a file-download API keyed by URI, test whether it accepts file:// URIs with ../ traversal and whether the preview iframe shares the origin that can call it; SSH keys in the home root are prime targets.