Finding a $90,000 Remote Code Execution Vulnerability in Google
A remote code execution (RCE) vulnerability was discovered in Google's OAuth flow. The flaw lies in the session cookie used for the OAuth flow. The cookie is made up of a Flask session payload containing a timestamp and signature. Initially, the cookie appeared to be 1,200 bytes long, more than enough for a CSRF token and return URL.
Upon decoding the cookie, it was revealed to be zlib-compressed. Further decoding yielded a pickle object. This pickle object contained the client_id and client_secret of Google's OAuth client. An attacker could reuse the leaked client secret as the Flask SECRET_KEY, leading to a successful signature verification. The attacker was able to forge a valid cookie, allowing them to set arbitrary keys and values in the session.
The server then unpickles the payload, which can execute arbitrary code. The vulnerability exposes a public signing key and a sink that can be manipulated for unauthenticated RCE.
Written by urgent.news from Lobsters's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
