Collected research

Using YouTube to steal your files Ʊ

Using YouTube to steal your files

A Google Slides YouTube embed takes only a video id, but a traversal points the iframe at any page on that host. Two token-less redirects, plus a legacy hop that defeats a fetch-metadata check, frame a Docs share dialog pre-filled with the attacker's address, so one disguised click grants Editor access to a victim's Drive files.

Record

Document

Using YouTube to steal your files

Published by

lyra's epic blog

Date

19 September 2024

Topic

Other

In the archive

• Collected in the 2024 research round

Related sources

• Using YouTube to Steal Your Files slides Slides
• BSides Tallinn talk recording
• Disobey talk recording

Tags

• clickjacking
• open-redirect
• path-traversal
• ui-redress
• iframe
• url-parsing
• sop-bypass
• attack-chain
• bug-bounty
• owasp-a01-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of lyra's epic blog, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.