TLDR Tech / Practical
Researcher Finds $90K RCE Flaw in Google Docs
A security researcher discovered a remote code execution vulnerability, valued at $90,000, impacting several Google developer documentation sites. The issue arose from an exposed OAuth client secret that was improperly reused as the signing key for Flask session cookies, leading to the unpickling of user-supplied data. By creating a forged session cookie using the compromised secret, an attacker could execute arbitrary code during the unpickling process.
Read the full story