A Cross-Site Scripting vulnerability in Google Cloud Looker could allow unauthorized actors to execute arbitrary scripts in the context of a user session.

This is an Improper Neutralization of Input during Web Page Generation flaw (CWE-79). The vulnerability allows an unauthenticated attacker to perform XSS attacks, which can lead to session hijacking or unauthorized actions if a user is tricked into interacting with malicious content.

The CVSS score of 8.7 reflects the high impact of this vulnerability, as it can lead to the compromise of user sessions and sensitive data within the Looker environment. Successful exploitation could result in unauthorized access to business intelligence reports and potential lateral movement within the application.

Immediate Action: For Looker-hosted instances, no action is required as Google has already mitigated the issue. For self-hosted instances, upgrade immediately to the patched versions provided by the vendor.

Proactive Monitoring: Review application access logs for suspicious URL parameters or input patterns that deviate from standard usage.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict XSS filtering rules to identify and block malicious injection attempts.

Public Exploit Available: Unknown

Organizations using self-hosted instances of Google Cloud Looker must verify their current version and apply the recommended updates immediately. The vendor has confirmed that cloud-hosted instances are already secured, significantly reducing the administrative burden for those users.