↓ Skip to main content
← All research

XSS in Google Tag Manager via JSON Import

1 min read Patrik Grobshäuser

Research summary

Google Tag Manager validated macro names in the web UI but not in the JSON container import path, so a payload smuggled through a file upload executed and earned a $5,000 bounty.

Products
Google, Google Tag Manager
Vulnerability
Stored XSS, File upload
Bounties
$5,000

Published in 2014. Product behaviour and tooling described here reflect that time.

I recently searched for vulnerabilities in a Google service called Tag Manager, which is used for SEO operations. My main research was to look for any field that could be vulnerable to Cross Site Scripting, but every field was protected against special characters as you can see in the image below. So it looked pointless to keep going down that path.

Google Tag Manager macro configuration screen showing the name field rejecting input that contains special characters

Finding the bug
#

The next thing I noticed was that Tag Manager allowed a user to upload a set of definitions, tags and macros in the form of a JSON file.

Google Tag Manager import screen offering to upload a container of definitions, tags and macros as a JSON file

Proof of concept
#

What I did next was download the sample JSON file and edit the name fields of the macros — the same fields that had rejected special characters in the UI:

      "data": {
        "name": "#\"><img src=/ onerror=alert(3)>",
        "type": "AUTO_EVENT_VAR",
        "autoEventVarMacro": {
          "varType": "HISTORY_NEW_URL_FRAGMENT"
        }

And guess what? After uploading and overwriting the settings, the payload executed.

Here’s the PoC video I sent in.

Proof-of-concept image submitted with the Google Tag Manager cross-site scripting report, showing the injected payload’s effect

— Patrik Grobshäuser

Stored XSSFile uploadFilter bypassimg onerror

Related