How I Found a $90,000 Remote Code Execution Vulnerability in Google
Summary
A security researcher details a remote code execution vulnerability in Google's DevSite via a forged Flask session cookie. The write-up explains how the cookie's signed-but-not-encrypted payload, its unsigned pickle data, and the signing key allow RCE, then outlines fixes such as rotating secrets, using per-deployment keys, keeping sensitive data server-side, and avoiding pickle across boundaries. The article provides practical lessons for developers and SMBs on preventing similar deserialization and session-signature flaws.