Hi guys im Hariharan.s aka P5YCHO.
Since you guys loved my previous writeups i decided to share one of my recent findings on google data studio.
What is google data studio ?
Google Data Studio is a dashboard and reporting tool that is easy to use, customize, and share. It allows you to transform your data into appealing and informative reports for your audience.
Let's get to the Bug :)
While i was doing some recon on the working of the website and its functions. The report sharing feature caught my eye, It had two options…
I got more information about the working of these functions from here. After learning what is does i decided to test whether i could bypass the restriction on the viewer side.
How these restriction works
- If the Disable downloading, printing and copying for viewers is not turned on, Then there will be a option to create a copy of the report on the viewer side. Viewers click on the option a request is sent to create the copy of the report.
2. If the Disable downloading, printing and copying for viewers is turned on , Then the option to create a copy of the report is disabled on the viewer side. So no request to sent.
The Bug ;)
The first thing that came to my mind was a thought of “What if i”
So the idea here was to sent the “Create a copy of the report” request when the Disable downloading, printing and copying for viewers is turned on.
So i created a report and captured the request of the “Create a copy of the report” option. The request was like :
POST u/0/copyReport/Report ID
Then i turned on Disable downloading, printing and copying for viewers for that report and replayed the same request above on the viewer side. And it happened, A copy of the report was created for the viewer.
Why You ask..
Because there was no validation on the server side for that request. And i was like ..
So i reported this issue to google and the issue was fixed on the below timeline:
Feb 5, 2020 :- Issue reported to google
Feb 7, 2020 :- Triaged as P2
Feb 10, 2020 :- Nice Catch
Feb 20, 2020 :- Accepted → Fixed
Feb 26, 2020:- Reward of $500 Issued and was added to their hall of fame
A Few things to say :
- Think out of the box.
- If you like my write up please do share so that others could learn something as well.
- If you need to connect with me → Linkedin, Twitter, Facebook.
Hope you guys liked this write up and Happy Hunting :)