Falla en Google DevSite permitió a atacantes ejecutar código remoto mediante sesiones Flask falsificadas

A critical vulnerability in Google’s shared DevSite platform could have allowed an unauthenticated attacker to forge Flask session cookies and trigger remote code execution across several Google-owned developer websites, according to researcher Simon Koeck. The issue affected the OAuth flow used by Google developer documentation sites, including developers.google.com, firebase.google.com, developer.android.com, source.android.com, and docs.partner.android.com.

The bug chain started with a Flask session cookie issued by the DevSite OAuth endpoint. Flask documentation states that the SECRET_KEY is used to sign session cookies and other security-sensitive data securely. After decoding the compressed payload, the researcher found a serialized OAuth flow object that included a Google OAuth client ID and client secret. Critical Google DevSite Flaw The discovery became more serious when Simon Koeck confirmed that the exposed OAuth client secret also served as the Flask session signing key, exposing the key within session data.

Simon Koeck dijo que Google solucionó el problema rotando los secretos del cliente de OAuth expuestos, invalidando las sesiones firmadas con ellos, separando los valores de Flask SECRET_KEY de las credenciales de OAuth y moviendo los objetos de flujo de OAuth al almacenamiento del lado del servidor. Integre el Sandbox de ANYRUN en su SOC La publicación Google DevSite Flaw Let Attackers Execute Remote Code Through Forged Flask Sessions apareció primero en Cyber Security News.

Consultar publicación original ↗