Google paid $90,000 for this bug, then waited two months to fix it
Google took two months to patch an unauthenticated RCE vulnerability in its developer documentation infrastructure. The problem was a reused The post Google paid $90,000 for this bug, then waited two months to fix it appeared first on The New Stack .
Google discovered and paid $90,000 for a critical security flaw in its developer documentation system, known as DevSite, but took two months to implement a fix. The vulnerability stemmed from the reuse of an OAuth client secret in DevSite's Flask session cookies, allowing anyone who recovered the secret to forge valid cookies and execute Python code on the server.
Software engineer Simon Könck from Otark GmbH identified the flaw, which affected seven Google domains. Könck exploited the vulnerability by forging a signed cookie with a malicious pickle payload, which executed when processed by the OAuth callback. The company initially rated the vulnerability S0, the highest severity level, and offered a $90,000 bounty for its resolution.
However, Google did not disclose the full scope of the issue, the extent of the exploitation, or whether any evidence of attacks occurred before the patch.
Written by urgent.news from The New Stack's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
