How I Found a $90,000 Remote Code Execution Vulnerability in Google
- How I found it I was mapping the OAuth flow that Google’s developer docs sites all share.
- You hit /oauth2authorize, it sets a Flask session cookie and redirects you to Google’s sign-in page.
- No account needed: curl -s -D headers.txt -o /dev/null \ 'https://developers.google.com/oauth2authorize?return_url=%2F' The cookie is what caught my eye.
Unverified
- How I found it I was mapping the OAuth flow that Google’s developer docs sites all share.
- You hit /oauth2authorize, it sets a Flask session cookie and redirects you to Google’s sign-in page.
- No account needed: curl -s -D headers.txt -o /dev/null \ 'https://developers.google.com/oauth2authorize?return_url=%2F' The cookie is what caught my eye.
Sources: Simonkoeck