Accelerating the search for antimicrobial peptides with Google Antigravity
deepmind.google·2h ago
Cloud & Infrastructure
The New Stack·2d ago·5 min read
Google paid $90,000 for this bug, then waited two months to fix it
TL;DR
A critical unauthenticated remote code execution (RCE) vulnerability was discovered in Google's DevSite infrastructure, leading to a $90,000 bounty for the finder. Google took two months to address the issue, which involved a reused OAuth client secret stored in a session cookie.
✦ Why It Matters
Review your OAuth client secret management to prevent similar vulnerabilities in your applications.
Key Takeaways
- Ensure OAuth secrets are not reused across applications.
- Implement strict session management practices.
- Regularly audit your application's security posture.
- Monitor for potential exploitation of known vulnerabilities.
How It Works
Köck exploited the vulnerability by reproducing the cookie's signature offline, allowing him to forge a session that the server would accept. The cookie contained a serialized OAuth2WebServerFlow object, which he replaced with a malicious payload.
When the server deserialized the cookie, the payload executed, demonstrating remote code execution.