# Stored XSS, and SSRF in Google using the Dataset Publishing Language

DSPL dataset metadata in Google Public Data Explorer allowed stored XSS on www.google.com and SSRF via remote file sources to reach localhost services.

- Payout: $13,337
- Severity: high
- Program: Google
- Credited: Craig Arendt
- Disclosed: 2018-03-07
- Write-up quality: 7/10
- Original: https://s1gnalcha0s.github.io/dspl/2018/03/07/Stored-XSS-and-SSRF-Google.html
- Library page: https://bugbountylibrary.com/r/blog%3As1gnalcha0s-github-io-dspl-2018-03-07-stored-xss-and-ssrf-google-html
- Tags: domain:web impact:ato impact:internal-access kind:bounty platform:blog sev:high tech:rest technique:source-review vuln:ssrf vuln:xss

**Target:** DSPL dataset upload (dataset.xml metadata and remote file sources)
**Root cause:** Dataset metadata values were rendered without context-aware encoding, and the remote file source feature fetched arbitrary HTTP/FTP URLs server-side without restriction.
**Steps:**
1. Download sample DSPL zip: `curl https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/dspl/tutorial1.0.zip -o sample.zip`
2. Unzip and edit dataset.xml `<info><name><value>` to `<![CDATA[<script>confirm(document.domain)</script>]]>`
3. Repackage: `zip -r poc.dspl *`
4. Upload to Google Public Data Explorer and share publicly; viewers execute JS on www.google.com
5. For SSRF, set `<file format="csv" encoding="utf-8">ftp://0.0.0.0:22</file>` in a table's data section
6. Upload; the error response reflects the fetched local service banner (e.g. SSH)
**How found:** Researcher examined DSPL sample dataset structure and noticed metadata values and remote file source fields were consumed without encoding/validation, then tested CDATA-wrapped script and ftp://0.0.0.0:22 payloads.
**Exploitation:** Attacker uploads a crafted DSPL bundle and shares it publicly; any viewer triggers stored XSS in www.google.com origin. SSRF variant causes the server to fetch attacker-specified HTTP/FTP URLs, leaking internal service responses via error messages.
**Escalation:** XSS in google.com origin could be chained to account actions; SSRF could reach internal non-internet-accessible systems.
**Insight:** Dataset/visualization import formats that accept XML metadata plus remote file URLs are prime spots: CDATA bypasses XML escaping for stored XSS, and the file-source field is a direct SSRF primitive whose error messages reflect internal banners.