Simon Koeck (@soeckly) earned $90,000 from Google after finding a DevSite vulnerability that let him run commands on Google's servers. The attack came down to 3 security mistakes that chained together. 1. A secret exposed in a session cookie Google's DevSite stored a pickled OAuth object inside a Flask session cookie, including its `client_secret`. The cookie was signed, but not encrypted. That means users couldn't modify it without invalidating the signature, but they could still decode and read its contents. So the researcher decoded the cookie and extracted the `client_secret`. 2. The same secret was used to sign cookies Normally, servers use a private key to sign session cookies so they can detect tampering. But DevSite used that exposed `client_secret` to derive its cookie-signing key. With the secret in hand, the researcher could now forge his own session cookies with valid signatures that Google's servers would accept. 3. Google used Python's `pickle` to deserialize cookie data `pickle` lets Python save objects as data and reconstruct them later. The problem is that loading malicious pickle data can execute arbitrary code. DevSite used `pickle` to restore an OAuth flow object from the session cookie. Since the researcher could forge valid cookies, he could replace the original pickled object with a malicious payload. Here's how the full attack worked: 1. Decode the session cookie and extract the `client_secret`. 2. Use that secret to derive the cookie-signing key. 3. Forge a valid session cookie containing a malicious pickle payload. 4. Send the cookie to DevSite and trigger the OAuth callback. 5. DevSite validates the cookie signature, deserializes the pickle, and executes the payload. To prove RCE, he made Google's server execute a command that delayed its response by a few seconds. The response times matched the delays. The takeaway: Three issues combined into one critical vulnerability: - Secret exposure → The signing key could be derived. - Key reuse → An attacker could forge trusted session cookies. - Unsafe deserialization → Forged data could execute code on the server. #BugBounty tip: Decode session cookies when testing applications. Signed doesn't mean encrypted, and sensitive information inside a cookie might be enough to compromise the mechanism protecting it. Full write-up 👇 simonkoeck.com/writeups/goog…