security A field note by Vikrant Sharma
Pickle deserialization just paid someone 90k
A researcher found remote code execution in Google's developer portal by exploiting Flask session cookies. The vulnerability chain is textbook insecure deserialization.
Simon Koeck just published a writeup on finding RCE in Google’s developer site that landed him a 90k bounty. The vulnerability is a classic insecure deserialization chain, the kind that makes OWASP’s top ten every year for good reason. The setup: Google’s developer portal used Flask sessions with a weak secret key. Flask sessions are just signed cookies containing serialized Python objects. Koeck found he could brute-force the secret key because it was only 128 bits of entropy, not nearly enough for a production system. Once he had the key, he could forge session cookies. Here is where it gets interesting. The session data was pickled. Pickle is Python’s built-in serialization format, and it is notoriously dangerous when handling untrusted input. You can embed arbitrary code in a pickle payload that executes during deserialization. Koeck crafted a malicious pickle that ran shell commands when the server unpickled his forged session cookie. The impact was full remote code execution on Google’s infrastructure. He could run arbitrary commands, read environment variables, access the filesystem. The writeup includes proof-of-concept code showing how he escalated from session forgery to command execution. Two things strike me about this. First, pickle is explicitly documented as unsafe for untrusted data, yet frameworks still use it in contexts where user input flows through. Second, the secret key weakness compounded the problem. Either flaw alone would have been fixable, but together they formed a critical vulnerability. The fix was rotating the secret key and moving away from pickle for session serialization. Google paid out 90k, which feels appropriate for RCE on production infrastructure. The researcher disclosed responsibly and waited for the patch before publishing. This is a good reminder that serialization bugs are not theoretical. They show up in real systems, including ones built by companies with mature security practices. If you are using pickle anywhere near user input, you probably want to reconsider that architecture.
Source: I Found a $90k Remote Code Execution Vulnerability in Google
