Finding a $90,000 Remote Code Execution Vulnerability in Google

simonkoeck.com

cross-posted to:
netsec

Finding a $90,000 Remote Code Execution Vulnerability in Google

simonkoeck.com

RSS Bot@lemmy.bestiver.seBM to Lobste.rs@lemmy.bestiver.seEnglish · 26 days ago

cross-posted to:
netsec

How I Found a $90,000 Remote Code Execution Vulnerability in Google | Simon Koeck

simonkoeck.com

A Flask cookie on developers.google.com was signed with a secret it carried inside itself. Pulling that secret out turned a forged session into code execution across Google's developer sites.

Comments

You must log in or register to comment.

Chat

Lobste.rs@lemmy.bestiver.se

lobsters@lemmy.bestiver.se

You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !lobsters@lemmy.bestiver.se

Community locked: only moderators can create posts. You can still comment on posts.

RSS Feed of lobste.rs

Source of the RSS Bot

Visibility: Public

This community can be federated to other instances and be posted/commented in by their users.

25 users / day
163 users / week
421 users / month
1.49K users / 6 months
1 local subscriber
415 subscribers
7.65K Posts
757 Comments
Modlog