This is a bug I reported to Google.
Below is an intact reproduction of the report sent to Google (I censored some parts):
Abstract
A variant of T12 occurs now in another API method. This API method is relatively new (I didn't find any mention of it in the Javascript code some months ago).
To summarize: the https://support.google.com/s/community/api/SuggestDuplicateThreads endpoint allows a user to retrieve, given that you provide a thread id and its forum id, a list of suggested threads related to the one provided. When making a POST request to that endpoint passing an appropriate JSON string as the body and authenticating as any user registered in the Google forums/communities via cookies, in case the response includes any suggested thread, each thread returned includes the IP address and country code of the corresponding author.
Reproduction steps
- Sign in with a Google Account in Chrome
- Open https://support.google.com/chrome/thread/17542816?hl=en and click the Upvote button (this action will automatically create a Forum/community user for the Google Account, which is needed for the API endpoint to work; otherwise it returns {"2":16,"4":"User not found"})
- Open the Developer Tools, go to the Network tab, and reload the page. Take note of the cookies header sent with the document request to the server (the main request).
- Now open a terminal and run the following command, where Cookie: abcxyz has to be substituted with the cookies header we grabbed at the previous step:
curl 'https://support.google.com/s/community/api/SuggestDuplicateThreads' -H 'Cookie: abcxyz' --data-binary '{"1":"[REDACTED]","2":"[REDACTED]"}' --compressed- In the JSON response, you'll see various IPv4 and IPv6 addresses.
Attack scenario
The same as T12, except that in the original issue you could directly request information about a thread and the information returned would include the IP address of the author (which means that you could target a thread easily). However, in this case the list returned by the endpoint is not strictly deterministic, and so it could be more difficult to get the IP address of the author of a specific thread. Therefore, I think it's not as critical, but that doesn't mean it's not critical at all, because if you wanted to target a specific thread, you could try passing related threads as the input of the endpoint, and you could eventually encounter the target thread in the list returned probably without much effort, even doing it manually.
This bug is subject to a 90 day disclosure deadline. If 90 days elapse without a broadly available patch, then the bug report will automatically become visible to the public.