Security researcher exploits Flask session cookie vulnerability on developers.google.com; extracts OAuth client secret used as signing key, achieves remote code execution across 7 Google domains, earns $90,000 bounty.

How I Found a $90,000 Remote Code Execution Vulnerability in Google

How I found it I was mapping the OAuth flow that Google’s developer docs sites all share. You hit /oauth2authorize, it sets a Flask session cookie and redirects you to Google’s sign-in page. No account needed: curl -s -D headers.txt -o /dev/null \ 'https://developers.google.com/oauth2authorize?return_url=%2F' The cookie is what caught my eye. Flask’s usual three-part session=<payload>.<timestamp>.<signature>, but about 1,200 bytes, way more than you need for a CSRF token and a return URL. So I d...