Google storage bucket takeover which is used to load JS file in dashboard.html in "github.com/kubernetes/release" which can lead to XSS
访问控制 / 访问控制缺陷（通用） / #1398706
该报告还没有中文解读。
原文摘录
摘自原文（1865 字符中的一小部分）
Summary: Kubernetes have a github repository [github.com/kubernetes/release](https://github.com/kubernetes/release) In the repository there is code for dashboard. The dashboard have a html file `dashboard.html` which is using a JS file from a google storage bucket. The bucket was not registered on …
原文中的代码
curl -s https://storage.googleapis.com/k8s-artifacts-prod-vuln-dashboard/takeover.html | base64 --decode
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Kubernetes 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @codermak · 版权归作者与 Kubernetes 所有