Google took two months to patch an unauthenticated RCE vulnerability in its developer documentation infrastructure. The problem was a reused OAuth client secret, which DevSite stored in a Flask session cookie and also used to sign sessions. Anyone who recovered the secret could forge a valid cookie and execute Python code on the server.

Simon Köck, a software engineer at Otark GmbH, discovered the flaw in Google’s DevSite infrastructure, the shared platform behind developers.google.com and several sibling documentation sites. Köck tells The New Stack that forged sessions were accepted on all seven affected domains, which relied on two different signing keys, and that he ran his code-execution proof on three of them, developers.google.com, docs.partner.android.com and web.dev.

Köck tells The New Stack that forged sessions were accepted on all seven affected domains, which relied on two different signing keys, and that he ran his code-execution proof on three of them

Google rated the vulnerability S0, the top of its severity scale, and awarded Köck a $90,000 bounty. That figure reflects a $75,000 base payout for an S0 RCE in what Google classifies as a normal application tier, multiplied by 1.2 for exceptional report quality.

Köck confirmed unauthenticated RCE with a Python sleep payload, measuring response delays that matched his payload, and deliberately stopped short of running commands or touching files, credentials, or internal services. “I’d call it an exceptionally serious RCE because anyone could reach it without an account or victim interaction,” he tells The New Stack , adding that he doesn’t know whether the three hosts he tested shared the same backend machines.

Source link