Google Pays $90,000 for Cookie-Signing Vulnerability Demonstrated as Server-Side Delay
· 1:34 · Watch on YouTube ↗
Summary
Simon Kowik found that a secret in a Google developer-site cookie could forge valid cookies and trigger Python pickle code execution. He demonstrated the issue with server delays, reported it, and Google fixed it.
Key points
- Simon Kowik found the cookie-signing secret embedded in a Google developer-site cookie.
- The exposed secret let him forge cookies that Google accepted.
- The site used Python's pickle module to unpack part of the cookie; a crafted pickle could call a function during loading.
- Kowik demonstrated the issue safely with time.sleep delays and did not run shell commands.
- The video says Google fixed the issue and paid a $90,000 bounty.
- The same signing key reportedly worked on several other Google developer sites.