In my security research I often come across weird quirks and behaviours that aren\u2019t particularly useful beyond a neat party trick. It\u2019s always a good idea to keep track of them though, perhaps one day they\u2019ll be just the missing piece you need.<\/p>\n
File<\/span>Edit<\/span>View<\/span>Insert<\/span>Format<\/span>Slide<\/span>Arrange<\/span>Tools<\/span>Extensions<\/span>Help<\/span> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n 1<\/p>\n Click to add title<\/p>\n Click to steal your files<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n Click to add title<\/p>\n Click to steal your files<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n <\/p>\n Who doesn\u2019t love cat videos?<\/p>\n Google Slides has this neat feature that lets you add YouTube videos to your presentations. Just open up the video picker, look for your favorite clip, and add it onto a slide.<\/p>\n What appears is an iframe that links to www.youtube.com\/embed\/{VIDEOID}<\/a><\/span> with your cute cat video playing inside of it. Pretty neat! But can we do anything beyond just playing a video?<\/p>\n Looking at the network traffic, it seems like adding a video onto a slide will send Slides the videoid, which it then uses to construct the embed URL for the iframe. We can\u2019t control the full URL, just the videoid part. Can we still do something?<\/p>\n The obvious thing to try here is path traversal – if we change the videoid to ..\/<\/strong>, the full url will be www.youtube.com\/embed\/..\/<\/a><\/span>, which should turn into just www.youtube.com\/<\/a><\/span>, leading us straight to the YouTube home page. Let\u2019s try it!<\/p>\nPart 1: Cat videos<\/h2>\n