I Found a $90k Remote Code Execution Vulnerability in Google
A security researcher discovered a critical remote code execution vulnerability in Google's developer documentation site. The flaw involved a Flask session cookie that contained a signing secret, allowing for unauthorized code execution across multiple Google domains.
Why it matters
This highlights the severe security risks associated with improper session management and the exposure of sensitive credentials in web applications.
A Flask cookie on developers.google.com was signed with a secret it was also carrying inside itself. Pulling that secret out turned a forged session into code execution across seven Google domains.
I was mapping the OAuth flow that Google’s developer docs sites all share. You hit /oauth2authorize , it sets a Flask session cookie and redirects you to Google’s sign-in page. No account needed:
curl -s -D headers.txt -o /dev/null \ 'https://developers.google.com/oauth2authorize?return_url=%2F' The cookie is what caught my eye. Flask’s usual three-part session=<payload>.<timestamp>.<signature> , but about 1,200 bytes, way more than you need for a CSRF token and a return URL. So I decoded it.
Flask session cookies are signed, not encrypted, so the contents are right there for anyone holding one. The leading dot means the payload is zlib-compressed:
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in