Security News > 2022 > May > Researchers uncover URL spoofing flaws on Zoom, Box, Google Docs

Researchers have discovered several URL spoofing bugs in Box, Zoom and Google Docs that would allow phishers to generate links to malicious content and make it look like it's hosted by an organization's SaaS account.

The vulnerabilities arise for a lack of validation of so-called vanity URLs, and they allow attackers with their own SaaS accounts to change the URL of the pages hosting malicious files, forms and landing pages, as to maximize their potential to trick users.

Creating malicious registration pages, employee login pages, and pages hosting meeting recordings, and make their URL and even their branding reflect that of a popular brand.

Creating Google Forms and Docs impersonating a specific company/brand.

The URL spoofing vulnerabilities have already been fixed by Box, but not all have been mitigated in Zoom and Google Docs.

"We can still reproduce the Google Docs and Google Forms bug. We can reproduce the Zoom webinar registration and recording in certain circumstances, but the user does get a warning message in all cases," the Varonis research team told Help Net Security.

News URL

https://www.helpnetsecurity.com/2022/05/11/url-spoofing-zoom-box-google-docs/