Google VRP Writeup: Insecure Direct Object Reference (IDOR) in Google Drive File Sharing
In April 2015, I reported an Insecure Direct Object Reference (IDOR) vulnerability to the Google Vulnerability Reward Program (Google VRP) affecting Google Drive and Gmail attachments. The flaw allowed an attacker to query document metadata, filenames, user account names, and direct download authorization hashes for arbitrary Google Drive accounts by manipulating internal directory object identifiers (docId). Google resolved the issue and awarded a $3,133.70 bounty. Background: Google Drive Sharing Flow When users share files in Google Drive or attach photos/documents via Gmail, Google generates a resource token (a unique file hash) and associates it with the user’s root folder collection (docId). ...