Google paid $90,000 for this bug, then waited two months to fix it

Google took two months to patch an unauthenticated RCE vulnerability in its developer documentation infrastructure. The problem was a reused OAuth client secret: DevSite stored it in a Flask session cookie and used it to sign sessions. Anyone who recovered the secret could forge a valid cookie and execute Python code on the server.

Simon Köck, a software engineer at Otark GmbH, discovered the flaw in Google’s DevSite infrastructure, which is the shared platform behind developers.google.com plus several sibling documentation sites. Köck says the same signing secret worked across seven Google domains, although he publicly documents code execution only on developers.google.com.

Google rated the vulnerability S0, the top of its severity scale, and awarded Köck a $90,000 bounty.

Google rated the vulnerability S0, the top of its severity scale, and awarded Köck a $90,000 bounty. That figure reflects a $75,000 base payout for an S0 RCE in what Google classifies as a normal application tier, multiplied by 1.2 for exceptional report quality.

Köck confirmed unauthenticated RCE using a Python sleep payload, stopping short of running shell commands or accessing sensitive data, which leaves open the question of what an attacker could have done with the DevSite process’s privileges.

One concern is whether an attacker could have modified Google’s developer documentation, replacing installation commands or download links with malicious ones. That could have enabled a supply-chain attack, but Köck didn’t test for write access to the content systems, and Google hasn’t disclosed DevSite’s process permissions or backend access, so the full blast radius remains unknown.

One OAuth secret, two jobs

Köck confirmed that Google had reused the OAuth client secret as DevSite’s Flask session-signing key by reproducing the cookie’s signature offline. With that key, he could forge sessions the server would accept.

The cookie carried a serialized OAuth2WebServerFlow object from Google’s oauth2client library, which Google has deprecated in favor of google-auth. Köck replaced that object with a malicious pickle payload and signed the forged cookie, and when the OAuth callback deserialized the session, the payload executed.

To verify RCE, Köck used Python’s time.sleep() and measured the resulting response delays. The delays matched his payload, confirming code execution without running shell commands or extracting data.

Pickle turns forgery into RCE

DevSite put a serialized OAuth flow object inside a Flask session cookie, exposing its client secret in the process. Google had also used that secret to sign the cookie, which meant Köck could forge sessions the server would trust.

The OAuth callback used Python’s pickle to deserialize session data, which allowed Köck’s payload to execute. Köck exploited all three issues in sequence, forging a signed cookie with a malicious pickle payload that executed when the OAuth callback processed it.

Köck exploited all three issues in sequence, forging a signed cookie with a malicious pickle payload that executed when the OAuth callback processed it.

Fixing any one of the three issues would have broken the chain, but combined, they turned DevSite’s OAuth flow into an unauthenticated RCE vulnerability.

Patch pace raises questions

Köck reported the vulnerability on August 6, and Google accepted it the following day. The company approved the bounty on August 27 but didn’t deploy a fix until October 7.

Google hasn’t explained the two-month remediation window or whether it implemented interim mitigations. Meanwhile, questions also remain about the fix itself.

Köck says seven domains were affected but publicly identified only five.

Köck says seven domains were affected but publicly identified only five. His recommendations mention two exposed OAuth client secrets, but Google hasn’t confirmed whether both were rotated or existing sessions invalidated. The company also hasn’t said whether it found evidence of exploitation before the patch.

Google and Köck were contacted for comment but had not responded by publication time.