Vulnerability Note VU#571584

Google Gmail cross-site request forgery vulnerability

According to a report on the GNUCITIZEN site, Gmail contained a cross-site request forgery (XSRF) vulnerability that allowed attackers to create mail filters and forward mail to arbitrary email addresses. To exploit this vulnerability, an attacker would have had to convince a user to click or open a specially crafted hyperlink while the user was logged into their Gmail account. The hyperlink would have contained an http POST request that created the mail filter.

II. Impact

The following workarounds may partially mitigate future cross-site scripting (XSS) and XSRF vulnerabilities:

Workarounds for users

• Using Gmail's SMTP and POP or IMAP servers to send and receive mail will mitigate vulnerabilities in the Gmail web interface.
• The NoScript Firefox extension may mitigate XSRF and XSS vulnerabilities by restricting which sites can execute JavaScript and send cross-site POST requests.
• Encrypting sensitive emails and attachments will limit the impact of XSRF or other authentication bypass vulnerabilities.

• Blacklisting known XSS or XSRF exploit URLs using proxy server or application firewall rules at the network permiter may prevent some vulnerabilities from being exploited. Note that this workaround will not stop all known XSS or XSRF attack vectors.

http://www.gnucitizen.org/blog/google-gmail-e-mail-hijack-technique/
http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html
http://mail.google.com/support/bin/answer.py?hl=en&answer=13273
http://noscript.net/
http://www.cert.org/homeusers/email_postcard.html

Credit

Information about this vulnerability was disclosed on the GNUCITIZEN web site.

This document was written by Ryan Giobbi.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.