Executive brief
Google::Auth for Perl is a library that manages authentication credentials for accessing Google services. Versions before 0.09 fail to validate URLs stored in credential configuration files before making network requests to them, allowing an attacker who can control the configuration to redirect credentials (including tokens and secrets) to arbitrary internal or external servers. This could compromise sensitive credentials and enable access to internal infrastructure.
Technical details
The vulnerability is a server-side request forgery (SSRF) coupled with credential exfiltration affecting Google::Auth versions before 0.09. The library reads token URLs, credential source URLs, and impersonation endpoints directly from user-supplied credentials JSON without validating them against a trusted universe domain. An attacker controlling the credentials JSON can redirect requests to arbitrary hosts, causing the library to send OAuth tokens, refresh tokens, JWTs, and client secrets to attacker-controlled or internal infrastructure. The vulnerability affects external_account, authorized_user, impersonated_service_account, and service_account credential types. Mitigation was applied incrementally across versions 0.06–0.09 through _validate_url host checks and environment-gated custom universe support, with complete coverage added in version 0.09 to ServiceAccountCredentials.
Affected products
- Google Auth before 0.09
Timeline
- 2026-08-04: disclosed