Google DevSite Flaw Let Attackers Execute Remote Code Through Forged Flask Sessions
A patched Google DevSite flaw let unauthenticated attackers forge Flask sessions and achieve remote code execution.
Stories per day · 30 days
4 RSS
Relatedgoogle3oauth3rce3devsite2pickle2session-forgery2bug-bounty1pickle-deserialization1vulnerability1
2 stories, newest first · one card per story
Stories tagged #flask
Critical Google DevSite Flaw Allowed Attackers to Execute Remote Code Without Authentication
Researcher Simon Köck found an unauthenticated RCE chain in Google DevSite via Flask session cookie forgery and unsafe pickle deserialization, earning $90,000.