Simon Köck, an engineer at Otark GmbH, uncovered a critical vulnerability in Google's DevSite infrastructure—the underlying platform powering developers.google.com and related documentation sites. The flaw stemmed from a single OAuth secret serving dual purposes: authenticating users and signing Flask session cookies. This design choice allowed Köck to forge authenticated sessions and inject malicious code that executed when the server processed them.
The same signing secret functioned across seven Google domains, though Köck's public disclosure documents code execution only on developers.google.com. Google classified the issue as S0, its highest severity rating, and issued a $90,000 bounty—comprising a $75,000 base for an S0 remote code execution vulnerability in a normal application tier, adjusted by 1.2 for exceptional report quality.
Köck validated unauthenticated RCE using a Python sleep payload to measure response delays, confirming execution without running shell commands or accessing sensitive data. The potential scope of the vulnerability remains unclear: an attacker might have modified developer documentation by replacing installation commands or download links with malicious alternatives, potentially launching a supply-chain attack. However, Köck did not test for write permissions to content systems, and Google has not disclosed the DevSite process's privileges or backend access controls.
How the Vulnerability Chained Together
DevSite stored a serialized OAuth2WebServerFlow object—from Google's deprecated oauth2client library—inside Flask session cookies. By reproducing the cookie's signature offline, Köck confirmed that Google had reused the OAuth client secret as the session-signing key. This meant he could forge sessions the server would accept.
The OAuth callback used Python's pickle module to deserialize session data, a dangerous practice that allows arbitrary code execution during deserialization. Köck replaced the legitimate OAuth flow object with a malicious pickle payload, signed the forged cookie using the exposed secret, and the server executed his code when processing the callback.
Three distinct issues combined to enable the attack: the exposed OAuth secret, its reuse as a signing key, and unsafe pickle deserialization. Fixing any single issue would have prevented exploitation, but together they transformed DevSite's OAuth flow into an unauthenticated RCE vector.
Timeline and Patching Delays
Köck reported the vulnerability on August 6, and Google acknowledged it the next day. The company approved the bounty on August 27 but did not deploy a fix until October 7—a gap of two months between bounty approval and remediation.
Google has not explained the extended remediation timeline or whether it deployed temporary mitigations during that period. Additional questions surround the completeness of the fix itself.
Köck identified seven affected domains but publicly disclosed only five. His recommendations reference two exposed OAuth client secrets, yet Google has not confirmed whether both were rotated or whether existing sessions were invalidated. The company also has not stated whether it detected any exploitation attempts before the patch was applied.