1742124 - Slack Leakage - Google Docs Plugin leads to credential and Mozilla Internal Information Disclosure

Status: RESOLVED FIXED

(Websites :: Other, task)

Description

[Griffin Francis]

Hi.

The implementation of the Google Docs Slack plugin leads to the disclosure of sensitive information through the document preview function. I do not need to be authenticated to a Mozilla email account to view the contents of the documents which are being shared.

I have noticed this behavior for awhile now, however at the time I was unable to find credentials which would further demonstrate the impact here. Recently I found a document which was being shared called "MLS API Keys in Use". This document details API keys for the https://location.services.mozilla.com/ website.

https://docs.google.com/spreadsheets/d/1BL6cpT4nW0HuQyUYbxtqFwJyTwn54maRNwN3S17z8j0/edit#gid=0

Initially I was having a hard time with reading the contents of the preview as it was quite small within the Slack program. However navigating to the slack.com website enabled me to view the contents of the document after scrolling and playing with the browser a bit more. From here I was able to view the contents of the API keys which are currently being used.

https://location.services.mozilla.com/v1/geolocate?key=3b4d27dd-703d-4094-8398-4de2c763505a (Firefox for Android)

The service APIs accept data submission for geolocation stumbling as well as reporting a location based on IP addresses, cell, or WiFi networks. I believe this feature is also being used within Firefox.

Whilst the impact of these keys might be questionable. It raises the question what else is being stored within these Google documents?

Regards,
Griffin.

Comment 1

[Jonathan Claudius [:claudijd] (use NEEDINFO)]

I'm not 100% sure, but I'm wondering if this functions similar to the concept of a consumer key/secret (https://stackoverflow.com/questions/28057430/what-is-the-access-token-vs-access-token-secret-and-consumer-key-vs-consumer-s).

Comment 2

[Frida K [:frida](Sick Leave 19-28/3 - expect delayed response)]

Hello Griffin,

Is this the mozilla slack instance? Do you still see examples of this issue? If so, can you point us to a message so we can see how the preview is leaking this data? I wonder if the plugin can be configured to prevent this behavior.

Thanks,
Frida

Comment 3

[Griffin Francis]

Hi Frida.

Yes this is within the Mozilla Slack instance. You can re-produce it through searching MLS API Keys in USE and it should return a document which you are able to preview.

Regards,
Griffin.

Comment 4

[Frida K [:frida](Sick Leave 19-28/3 - expect delayed response)]

opened a ticket with IT to look into it, https://mozilla-hub.atlassian.net/servicedesk/customer/portal/4/SDD-2824

Comment 5

[Frida K [:frida](Sick Leave 19-28/3 - expect delayed response)]

We requested Slack to disable previews (i.e. unfurling) for google docs.

Comment 6

[Daniel Veditz [:dveditz]]

None of the involved sites (slack, google docs, jira) are officially on our web bounty list, and our bounty program is more focused on danger to our users and their data, but this is a good find of a flaw that is disruptive to our own internal working and we do want to recognize that with a bounty.

Comment 7

[Griffin Francis]

Thanks for the bounty!