Technology
Researcher reports Google DevSite flaw enabled code execution, earning $90,000 bounty
Hacker News reports that a researcher's write-up describes forged Flask sessions yielding code execution across seven Google domains.
The short version
- A researcher says a Flask cookie on developers.google.com was signed with a secret it also contained, enabling code execution.[Hacker News]
- The researcher says the same key signed valid sessions on firebase.google.com, developer.android.com, source.android.com, and docs.partner.android.com.[Hacker News]
- The reward was decided at $90,000, based on a $75,000 base and a 1.2 multiplier for report quality.[Hacker News]
Key facts
- A Flask cookie on developers.google.com was signed with a secret the cookie also contained, according to the researcher's write-up.[Hacker News]
- The cookie carried a pickle-serialized payload and Google OAuth client_id and client_secret values in plaintext.[Hacker News]
- The researcher reports that the client secret validated the cookie signature when used as the Flask SECRET_KEY.[Hacker News]
- The researcher reports that response times tracked the sleep value in a test payload, which the author said indicated server-side execution.[Hacker News]
- The researcher reports that the same key signed valid sessions on firebase.google.com, developer.android.com, source.android.com, and docs.partner.android.com.[Hacker News]
- The reward was decided at $90,000: a $75,000 base for Normal Google Applications (T2), S0 RCE, multiplied by 1.2 for exceptional report quality.[Hacker News]
What remains uncertain
- All technical details rest on the researcher's own write-up, as summarized by Hacker News; no independent Google confirmation appears in the provided reporting.[Hacker News]
- The reporting does not say whether the flaw was exploited before it was fixed.[Hacker News]
Sources
Outlet counts describe coverage, not independent confirmation. Reports may share a wire service or original source.