I Found a $90k Remote Code Execution Vulnerability in Google
A Flask cookie on developers.google.com was signed with a secret it was also carrying inside itself. Pulling that secret out turned a forged session into code execution across seven Google domains.
Summary
A security researcher discovered a critical vulnerability in Google that allowed remote code execution by extracting a secret from a signed Flask cookie. This flaw impacted multiple Google domains, highlighting significant security risks in the company’s systems.
Comments (101 of ) ⌛