↓ Skip to main content
A concrete service ramp descending beneath a large building toward a goods entrance below street level.
Photo by Anton Rybakov on Unsplash
  1. Research/

XSS in Google Tag Manager via JSON Import

·1 min
Stored XSS File upload Filter bypass img onerror
Patrik Grobshäuser
Author
Patrik Grobshäuser
Security researcher at Assetnote / Searchlight Cyber. Before that, seven years triaging other people’s reports at HackerOne and Shopify. Hunting bugs since 2012, published as Patrik Fehrenbach until 2025.
Table of Contents

I recently searched for vulnerabilities in a Google service called Tag Manager, which is used for SEO operations. My main research was to look for any field that could be vulnerable to Cross Site Scripting, but every field was protected against special characters as you can see in the image below. So it looked pointless to keep going down that path.

Google Tag Manager macro configuration screen showing the name field rejecting input that contains special characters

Finding the bug
#

The next thing I noticed was that Tag Manager allowed a user to upload a set of definitions, tags and macros in the form of a JSON file.

Google Tag Manager import screen offering to upload a container of definitions, tags and macros as a JSON file

Proof of concept
#

What I did next was download the sample JSON file and edit the name fields of the macros — the same fields that had rejected special characters in the UI:

      "data": {
        "name": "#\"><img src=/ onerror=alert(3)>",
        "type": "AUTO_EVENT_VAR",
        "autoEventVarMacro": {
          "varType": "HISTORY_NEW_URL_FRAGMENT"
        }

And guess what? After uploading and overwriting the settings, the payload executed.

Here’s the PoC video I sent in.

Proof-of-concept image submitted with the Google Tag Manager cross-site scripting report, showing the injected payload’s effect

— Patrik Grobshäuser

Related