Tuesday, June 6, 2017

ThunderScan Discovered Multiple Vulnerabilities in Google API Client Library for PHP

Hi,

During the security audit of Google APIs Client Library for PHP multiple XSS vulnerabilities were discovered using DefenseCode ThunderScan SAST application source code security analysis platform. The Google API Client Library for PHP is designed for PHP client-application developers. It offers simple, flexible, powerful access to many Google APIs such as Google+, Drive, or YouTube.

The Cross-Site Scripting vulnerability can enable the attacker to construct the URL that contains malicious JavaScript code. If the administrator of the site makes a request to such an URL, the attacker's code will be executed, with unrestricted access to the site in question. The attacker can entice the administrator to visit the URL in various ways, including sending the URL by email, posting it as a part of the comment on the vulnerable site or another forum. Once the unsuspecting user has visited such an URL, the attacker can proceed to send requests to the API on the behalf of the victim from his JavaScript.

Full advisory can be read on the following URL: http://www.defensecode.com/advisories/DC-2017-04-012_google-api-php-client_Advisory.pdf

Regards,
DefenseCode Team

40 comments:

  1. Very interesting to read this article.I would like to thank you for the efforts you had made for writing this awesome article. madalin stunt cars

    ReplyDelete
  2. I know there will be many difficulties and challenges but I am determined to do it. If it does not succeed then it will be a lesson for me as well catmario4.com

    ReplyDelete
  3. It is imperative that we read blog post very carefully. I am already done it and find that this post is really amazing.
    obat gabagen
    obat ginjal bengkak
    obat keloid
    obat limpa bengkak
    obat thalasemia
    obat kencing tidak tuntas
    obat tbc tulang

    ReplyDelete
  4. nice blog
    TO LEARN

    1) data science

    2)Machine Learning

    3) IOT

    4) cloud computing

    5)ethical hacking

    ReplyDelete
  5. https://www.livelearn.co.in/course/data-science
    https://www.livelearn.co.in/course/aws-sysops-administrator-associate

    ReplyDelete
  6. As for me, it's quite important to make homework fun. You can check this out and find really useful advices about it

    ReplyDelete
  7. It is common to find ourselves in situation where the dates to vacate your facilityis predetermined and you are not ready yet to move into the would-be facility. The situation may apply to both – home as well as office. In such situations, you could opt for our storage and warehousing services.
    packers and movers satna
    packers and movers bhilai
    packers and movers in cuttack
    packers and movers in durgapur
    packers and movers in meerut
    packers and movers rajahmundry
    packers movers jodhpur
    packers and movers kakinada
    packers and movers korba
    packers and movers dhanbad

    ReplyDelete
  8. Anyone reading this text must have come across the need for a home relocation. This requirement is typical of the city life andcareer-moves. Moving India provides comprehensive home relocation covering not only the furniture, fixtures and utensils but also your vehicle and pets.
    packers and movers thrissur
    packers and movers in belgaum
    packers and movers kharagpur
    packers & movers in nagpur
    packers and movers btm layout

    ReplyDelete
  9. I really appreciate this wonderful post that you have provided for us. I assure this would be beneficial for most of the people download instagram stories

    ReplyDelete
  10. Packers and Movers Chennai Give Safe and Reliable ***Household Shifting Services in Chennai with Reasonable ###Packers and Movers Price Quotation. We Provide Household Shifting, Office Relocation, ✔✔✔Local and Domestic Transportation Services, Affordable and Reliable Shifting Service Charges @
    Packers And Movers Chennai

    ReplyDelete
  11. Packers and Movers Bangalore as a Services providing company can make all the difference to your ###Home Relocation experience. Bangalore based Company which offers versatile solutions, Right team that easily reduce the stress associated with a ✔✔✔Household Shifting, ***Vehicle Transportation. we help things run smoothly and reduce breakages and offer you seamless, Affordable, Reliable Shifting Services, Compare Shifting Charges @
    Packers And Movers Bangalore

    ReplyDelete
  12. Hire Best Packers And Movers Mumbai for hassle-free Household Shifting, ***Office Relocation, ###Car Transporation, Loading Unloading, packing Unpacking at affordable ✔✔✔ Price Quotation. Top Rated, Safe and Secure Service Providers who can help you with 24x7 and make sure a Untroubled Relocation Services at Cheapest/Lowest Rate
    Packers And Movers Mumbai

    ReplyDelete
  13. Packers and Movers Gurgaon Provide Reliable, Safe and Certified Service Provider list, Get Free ***Best Price Quotaition and Compare Charges. ✔✔✔ Hassle free Household Shifting Services, High Quality packing Material, Office Relocation, Car Transportaion, ###Local and Domestic Shifting Service @
    Packers And Movers Gurgaon

    ReplyDelete

  14. تمتلك شركة تنظيف مكيفات بالرياض افضل الطرق والمعدات في تنظيف الواحدات الداخلية والخاريجة للمكيفات توفر تنظيف المكيفات الاسبلت الفريون الكاست شركة غسيل مكيفات توفر خدمة تعبئة الفريون بسعر مميز شركة نظافة مكيفات تساعد علي رفع كفاءة التشغيل مرة اخري
    تنظيف مكيفات بالرياض
    شركة تنظيف مكيفات اسبلت بالرياض

    ReplyDelete
  15. You were the shadow to my light
    Did you feel us
    Another start
    You fade away
    Afraid our aim is out of sight
    Wanna see us
    Alive

    Obat Pembengkakan Hati
    Cara Mengatasi Albumin Rendah
    Obat Batu Ginjal
    Obat Vertigo
    Obat Laringitis
    Obat Penambah Hb Darah

    ReplyDelete

  16. Buy the best garden sheds nz online in Newzealand. We provide you quality products at low prices. Treasurebox
    also provide you home delievery services in Auckland Newzealand.

    ReplyDelete
  17. Get Shifting/Relocation Quotation from ###Packers and Movers Delhi. Packers and Movers Delhi 100% Affordable and Reliable ***Household Shifting Services. Compare Transportation Charges and Save Time, Verified and Trusted Packers and Movers in Delhi, Cheap and Safe Local, Domestic House Shifting @
    Packers and Movers Delhi

    ReplyDelete
  18. The mission of Nishtha is to promote that knowledge base along with ethics and good conduct in professionals, educate and orient them in the field of project management and develop skills in them that would then bring immense value in Organizations for management of their projects in a superior and successful manner.
    pmp training chennai
    ms project training in chennai
    pmp certification online
    pmp classes in chennai

    ReplyDelete
  19. One of the primary tools in traditional Chinese medicine, acupuncture is a safe and tested approach to holistic healing used to relieve pain, prevent disease, and restore balance in the body. Acupuncture involves the insertion of fine, sterile needles into specific locations of the body to elicit a therapeutic response. While some may be quick to assume that acupuncture is painful, many patients report a feeling of deep relaxation and increased energy both during and following treatment.
    physiotherapy calgary nw
    physiotherapy calgary
    Acupuncture Calgary nw
    Best Chiropractor Calgary nw
    sports massage calgary nw
    massage therapy nw calgary
    Exercise Therapy Calgary nw

    ReplyDelete
  20. Acupuncture is designed to help facilitate blood flow, remove muscle obstructions, and relax the nervous system. Those who undergo treatment at our facility may experience a decrease in ongoing pain and improvement in sleep and digestive issues. At Beddington Physiotherapy Ltd, we’re committed to providing effective, comprehensive acupuncture treatments in a warm, welcoming environment. So if you’re thinking about acupuncture, we invite you to visit our facility to learn more.
    physiotherapy calgary
    physiotherapy nw calgary
    Acupuncture Calgary
    Physiotherapy Calgary NW
    spinal manipulation treamtment in Calgary
    massage therapy Calgary nw
    Exercise Therapy Calgary
    Exercise physiotherapy Calgary

    ReplyDelete
  21. The website is looking bit flashy and it catches the visitors eyes. Design is pretty simple and a good user friendly interface.
    webnovel

    ReplyDelete
  22. SysAppPro, Gurgaon, India, gives steady SAP HR preparing in Gurgaon, India, Our SAP HR course consolidates fundamental measurement to imaginative dimension and that we have sorted out our SAP HR course substance and calendar sharp about understudies prerequisite to achieving everyone's livelihood objective. we tend to gives a sensitive copy of material, study hall Material, Real Time conclusions for understudies.

    For More Info:- SAP HR Course in Gurgaon

    ReplyDelete
  23. The presentation is broke down with the speed and the recuperation or congruity is a significant factor to be dissected. The KPI dependent on the accessibility of the interim is utilized by the organizations for the presentation of the DBA. The Oracle highlights and outsider devices are utilized to back up the information. Oracle DBA Training in Gurgaon is the best training to have an incredible future with potential development.

    For More Info:- Oracle DBA course in Gurgaon

    ReplyDelete
  24. We At Cheam Airport Services Come Up With Top Quality, Highly Professional And Timely Services To Our All Important Clients Irrespective Of The Location.
    cheam cabs
    gatwick taxi
    taxi to stansted
    heathrow minicab
    luton airport taxi

    ReplyDelete
  25. We At Epsom Airport Minicabs Services Come Up With Top Quality, Highly Professional And Timely Services To Our All Important Clients Irrespective Of The Location.
    cabs in epsom
    gatwick airport taxi
    stansted airport taxi
    heathrow cabs
    luton minicab

    ReplyDelete
  26. We are a reputed airport transport providing company providing reliable taxi, Minibus & airport transfer services 24/7 in London.
    Cheap Airport Minibus
    Gatwick 7 Seater minibus
    Stansted Airport Minibus
    Heathrow 8 Seater minibus
    Airport minibus to epsom
    Cheam 9 Seater minibus

    ReplyDelete
  27. The article was great, I accidentally saw it and I was really attracted to it, hoping it would be well known. This post is very useful, I admire the author, hope you will succeed in the next post, I will continue to follow your post.
    cá koi mini, abcya 2, friv Games for kids 2019, jogos io 2019

    ReplyDelete
  28. The choices obtainable via Internet sports activities betting web sites are several and assorted. Outfitted with the right information, you can appreciate a myriad of betting options. Considerably like the inventory market, realizing when to wager a moving line
    asikqq
    dewaqq
    sumoqq
    interqq
    pionpoker
    bandar ceme
    hobiqq
    paito warna terlengkap
    http://199.30.55.59/dewaqq78/
    data hk

    ReplyDelete