How I Found a $90,000 Remote Code Execution Vulnerability in Google
A leaked Flask session signing secret let an attacker forge session cookies containing malicious pickled data, turning OAuth state handling into unauthenticated remote code execution on several Google developer sites. The writeup shows how combiningpicklewith client-controlled session data can turn a secret leak into code execution, and why untrusted data should never cross a pickle dese...
https://simonkoeck.com/writeups/google-devsite-flask-session-pickle-rce
A leaked Flask session signing secret let an attacker forge session cookies containing malicious pickled data, turning OAuth state handling into unauthenticated remote code execution on several Google developer sites. The writeup shows how combiningpicklewith client-controlled session data can turn a secret leak into code execution, and why untrusted data should never cross a pickle dese...
https://simonkoeck.com/writeups/google-devsite-flask-session-pickle-rce
Simon Koeck
How I Found a $90,000 Remote Code Execution Vulnerability in Google | Simon Koeck
A Flask cookie on developers.google.com was signed with a secret it carried inside itself. Pulling that secret out turned a forged session into code execution across Google's developer sites.