A security researcher found a remote code execution vulnerability in Google's developer documentation sites. While mapping the OAuth flow shared across these sites, the researcher noticed that the /oauth2authorize endpoint set an unusually large Flask session cookie, about 1,200 bytes, far more than a CSRF token and return URL would require. Flask session cookies are signed but not encrypted, so the contents were readable by anyone holding one.
Decoding the cookie revealed a pickle-serialized object containing Google's OAuth client_id and client_secret in plaintext. The researcher found that the client secret also served as the Flask SECRET_KEY, meaning the same value both held and verified the signature. Because the signing key was exposed inside the cookie itself, the researcher could recompute valid signatures offline and forge arbitrary session data.
The callback endpoint reads the OAuth flow data from the session and passes it to pickle.loads. With a forged session, an attacker could supply a malicious pickle payload, making this an unauthenticated remote code execution path. The researcher verified the issue safely by using a payload that only triggered time.sleep, avoiding any commands on Google's production systems.
The finding illustrates how storing secrets in client-side session data, and deserializing untrusted pickle data, can compound into a critical vulnerability. The bug earned a $90,000 bounty.
Source: Hacker News · Summarized by HeadlinesBriefing