Expert claims to have found unrestricted file upload vulnerability in YouTube

snoopy · Mar 12, 2014

Expert Finds File Upload Vulnerability in YouTube, Google Denies It’s ...
Nicholas Lemonias is the one who found and reported the bug to Google

Nicholas Lemonias, an information security expert with Advanced Information Security Corp and Msc in Information Security from the University of Derby, England, has identified an unrestricted file upload vulnerability in YouTube. However, Google denies that the researcher’s findings represent a security issue.
On February 26, Lemonias informed Google, through the company’s security program, of a security issue that allowed him to circumvent web-based control handlers used by the YouTube API, which determines which file types can be uploaded to YouTube’s servers.

While the expert and his team believe that this should be regarded as a security issue, Google disagrees. The search engine giant’s representatives have confirmed for Softpedia that they’ve received Lemonias’ report.

“We did receive the report, but based on the information submitted, we do not believe it to be a valid security issue. So we have closed the case without forwarding it to the product team and have not made any product changes as a result of this submission,” they noted in an emailed statement.

Google highlights the fact that they’ve rewarded thousands of people who have submitted security issues. On the other hand, Lemonias says experts from OWASP and other organizations agree that his findings represent a security issue. He has provided Softpedia with a POC video demonstrating his findings.

He believes that the issue impacts the integrity and scope of information flow of YouTube's service. The expert also points to the email in which Google confirms that the files have been uploaded to its servers.
Click to expand...

http://news.softpedia.com/news/Expe...gle-Denies-It-s-a-Security-Issue-431489.shtml

Log in or Sign up

Expert claims to have found unrestricted file upload vulnerability in YouTube

snoopy Registered Members

Share This Page

Log in or Sign up

Expert claims to have found unrestricted file upload vulnerability in YouTube

snoopy Registered Members

Share This Page

Useful Searches