Google Adwords(Privilege Escalation): Read-only user able to add YouTube channels via Linked accounts
STEWIE NOT DOG, HUNT SOME BUGS MY BOY!!!!
Google AdWords , is Google's advertising system in which advertisers bid on certain keywords in their searchable ads. Since advertisers have to pay for these clicks, Google makes money from search.
ISSUE: A user with read only access to the adwords account was able to link Youtube channels to the adwords account.
Reported: 5th April
Steps to reproduce:
1. Go to https://adwords.google.com create a test adwords account.
From settings, Account access add another userA with Read-only access
(Here's the access right is allocated as read only users)
3. Go to user A mail account and accept the invitation to join the adwords account.
4. from user A adwords account go to settings then Linked accounts and then youtube, with below description:
Link a YouTube channel to your AdWords account to gain greater insights about your customers.
5. Add a youtube channel and accept the same via your youtube account.
the channel is added to the adwords account.
the check was missing while linking the youtube accounts,a request was send and post approval the accounts were linked. same worked for account unlinking, user with read only access can unlink admin's linked youtube account.
Bounty: 17th April
Thanks Google VRP for the fix and reward.