Gtron Solutions, LLC

A flaw in Google Code was recently uncovered by Billy Rios. Successful exploitation could have resulted in a hacker's ability to steal passwords from developers that had registered on the site. The vulnerability has since been fixed by the Google Security Team.

Rios used a crafted Java applet to a project on code.google.com as an issue to gain cross-domain access. Files uploaded as issues via the Google domain can be accessed. According to Rios, this method of attack usually employs a crafted Flash applet, but this time that would not work. The reason is that only subdirectories of the domain can be accessed by the Flash applet. What Rios realized is that the Java security model allows for access to the complete domain and so makes it possible to for an external Web site to load an injected Java applet under the Google domain while maintaining communication with the Google server.

As of yet there is no software or appliance that can prevent this sort of cross domain access, but it should be noted that Google's Security Team patched the vulnerability very quickly.

REFERENCES:
heise online UK
Password theft via vulnerability in Google code