# Google storage bucket takeover which is used to load JS file in dashboard.html in "github.com/kubernetes/release" which can lead to XSS

Unclaimed GCS bucket referenced by Kubernetes vulndash dashboard.html/js was registerable, letting attacker host malicious JS and JSON leading to XSS.

- Payout: hidden
- Severity: medium
- Program: Kubernetes
- Found by: codermak
- Disclosed: 2021-12-16
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1398706
- Library page: https://bugbountylibrary.com/r/h1%3A1398706
- Tags: area:web3 domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:gcp tech:s3 technique:source-review vuln:misconfiguration vuln:subdomain-takeover vuln:xss

**Target:** Google Cloud Storage bucket referenced by vulndash dashboard HTML/JS
**Root cause:** dashboard.html and dashboard.js load a JS file and JSON data from a GCS bucket (k8s-artifacts-prod-vuln-dashboard) that was never registered, so anyone could claim it.
**Steps:**
1. Open https://github.com/kubernetes/release/blob/master/cmd/vulndash/dashboard.html#L6 and note `storage.googleapis.com/k8s-artifacts-prod-vuln-dashboard`
2. Register the unclaimed GCS bucket name
3. Upload `takeover.html` (base64 PoC message) and a malicious JS/JSON payload
4. Fetch `https://storage.googleapis.com/k8s-artifacts-prod-vuln-dashboard/takeover.html` and decode with `curl -s ... | base64 --decode` to confirm control
5. Load the dashboard so it pulls the attacker-controlled JS/JSON, executing script in dashboard origin
**How found:** Reading dashboard.html source, spotted a hardcoded storage.googleapis.com bucket URL; checked whether the bucket existed and found it unregistered, so claimed it.
**Exploitation:** Attacker registers the dangling GCS bucket, hosts malicious JS referenced by dashboard.html and malicious JSON consumed by dashboard.js; when the dashboard loads, attacker script runs in its origin and data shown is attacker-controlled.
**Insight:** Grep frontend/static assets for hardcoded cloud storage hostnames (storage.googleapis.com, s3.amazonaws.com) and test whether the bucket name is actually registered — unclaimed names are claimable and yield script execution in the referencing origin.