Restriction is not a promise : Privilege escalation on Google.

Hi guys im Hariharan.s aka P5YCHO.

Since you guys loved my previous writeups i decided to share one of my recent findings on google data studio.

What is google data studio ?

Google Data Studio is a dashboard and reporting tool that is easy to use, customize, and share. It allows you to transform your data into appealing and informative reports for your audience.

Let's get to the Bug :)

While i was doing some recon on the working of the website and its functions. The report sharing feature caught my eye, It had two options…

Sharing options for editors and viewers

I got more information about the working of these functions from here. After learning what is does i decided to test whether i could bypass the restriction on the viewer side.

How these restriction works

Option to create a copy

2. If the Disable downloading, printing and copying for viewers is turned on , Then the option to create a copy of the report is disabled on the viewer side. So no request to sent.

No option to create a copy

The Bug ;)

The first thing that came to my mind was a thought of “What if i”

So the idea here was to sent the “Create a copy of the report” request when the Disable downloading, printing and copying for viewers is turned on.

So i created a report and captured the request of the “Create a copy of the report” option. The request was like :

POST u/0/copyReport/Report ID

Then i turned on Disable downloading, printing and copying for viewers for that report and replayed the same request above on the viewer side. And it happened, A copy of the report was created for the viewer.

Why You ask..

Because there was no validation on the server side for that request. And i was like ..

So i reported this issue to google and the issue was fixed on the below timeline:

Feb 5, 2020 :- Issue reported to google

Feb 7, 2020 :- Triaged as P2

Feb 10, 2020 :- Nice Catch

Feb 20, 2020 :- Accepted → Fixed

Feb 26, 2020:- Reward of $500 Issued and was added to their hall of fame

Bounty :)

A Few things to say :

Hope you guys liked this write up and Happy Hunting :)

P5YCH0_S3C

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store