# Google bug bounty for security exploit that influences search results

Google's sitemap ping followed cross-domain open redirects, letting attackers submit sitemaps for victim domains and use hreflang to hijack rankings.

- Payout: $5,000
- Severity: medium
- Program: Google
- Credited: Tom Anthony
- Disclosed: 2018-03-27
- Write-up quality: 8/10
- Original: http://www.tomanthony.co.uk/blog/google-xml-sitemap-auth-bypass-black-hat-seo-bug-bounty/
- Library page: https://bugbountylibrary.com/r/blog%3Atomanthony-co-uk-blog-google-xml-sitemap-auth-bypass-black-hat-seo-bug-bounty
- Tags: domain:web impact:integrity kind:bounty platform:blog sev:medium technique:chained technique:recon vuln:access-control vuln:business-logic vuln:open-redirect

**Target:** XML sitemap ping endpoint / search indexing pipeline
**Root cause:** The sitemap ping mechanism followed cross-domain redirects and still attributed the fetched sitemap to the redirecting (victim) domain, so an attacker-controlled sitemap was treated as authoritative for a site they did not own.
**Steps:**
1. Find an open redirect on victim.com, e.g. `https://victim.com/redirect?url=https://evil.com/evil.xml`.
2. Host `evil.xml` on evil.com containing only victim.com URLs, each with `hreflang` pointing to an equivalent evil.com URL as the US version.
3. Ping Google's sitemap endpoint with the victim.com open-redirect URL so Google follows the redirect to evil.xml.
4. Google associates evil.xml with victim.com and processes the hreflang directives, letting evil.com borrow victim.com's link equity.
5. Observe evil.com ranking for competitive terms within days and GSC showing victim.com linking to evil.com.
**How found:** Researcher knew sitemap pings accept arbitrary URLs and that GSC rejects cross-domain sitemaps; he hypothesized the ping path might not enforce the same domain check, then tested whether Google follows cross-domain redirects and still attributes the sitemap to the redirecting domain.
**Exploitation:** Attacker registers a cheap domain, mirrors victim content, and submits a malicious sitemap via the victim's open redirect through Google's ping URL. Google follows the cross-domain redirect, trusts the sitemap as victim.com's, and hreflang directives transfer link equity to the attacker's site, yielding free first-page rankings for monetizable terms.
**Escalation:** Once Google linked the sites, the attacker could also submit sitemaps for victim.com inside GSC for evil.com and track indexation, scaling to thousands of indexed pages and over a million impressions.
**Insight:** When a crawler/fetcher accepts a URL and follows redirects, test whether authorization is bound to the original host or re-evaluated after the redirect; open redirects become serious when a trusted fetcher attributes fetched content to the redirecting origin.