Critical Google DevSite Vulnerability (CVE-2023-XXXX) Allowed Remote Code Execution

Key Takeaways

• A critical vulnerability (CVE-2023-XXXX) in Google’s DevSite platform allowed unauthenticated remote code execution (RCE).
• The flaw affected multiple Google developer websites, including developers.google.com and firebase.google.com.
• The issue stemmed from exposed Flask session signing keys and unsafe deserialization of session data.
• Google patched the vulnerability on October 7, 2026, after a researcher reported it, awarding $90,000.

A severe security flaw within Google’s shared DevSite platform could have enabled an attacker to achieve remote code execution (RCE) across various Google-owned developer websites without needing authentication. This vulnerability involved the forging of Flask session cookies, as detailed by security researcher Simon Koeck.

The impacted Google developer documentation sites included prominent platforms such as developers.google.com, firebase.google.com, developer.android.com, source.android.com, and docs.partner.android.com, all of which utilized the vulnerable OAuth flow.

Google swiftly addressed the vulnerability on October 7, 2026, following its initial report in August. The company recognized the researcher’s contribution through its Vulnerability Reward Program, issuing a $90,000 payout.

The exploit chain originated with a Flask session cookie generated by the DevSite OAuth endpoint. While Flask’s standard session mechanism signs cookies to ensure their integrity, it does not encrypt their contents. This design choice means that users can inspect the data stored within the cookie, even if they cannot modify it without the server’s secret signing key. Flask documentation explicitly states that the SECRET_KEY is vital for securely signing session cookies and other sensitive information.

In this particular instance, the cookie contained more than just a CSRF token and a return URL. Upon decompressing the payload, the researcher discovered a serialized OAuth flow object. This object surprisingly included a Google OAuth client ID and, critically, a client secret.

Critical Google DevSite Flaw Uncovered

The severity of the discovery escalated significantly when Simon Koeck confirmed that the exposed OAuth client secret was also being used as the Flask session signing key. This critical misconfiguration meant that the key intended to protect session integrity was itself exposed within the session data.

Any individual obtaining a session cookie could extract this secret, subsequently generate a new valid signature, and craft a fraudulent session that the server would accept as legitimate. This effectively neutralized the primary security control designed to prevent client-side session tampering.

While the ability to forge sessions alone posed a significant risk, allowing attackers to manipulate values stored in the Flask session, the potential for remote code execution stemmed from how the DevSite OAuth callback processed an object within that session.

The application reportedly Base64-decoded the OAuth flow data before passing it to Python’s pickle.loads() function. Python’s own documentation explicitly warns against the inherent insecurity of the pickle module, advising developers to only unpickle data from trusted sources. This is because a malicious pickle payload can execute arbitrary code during the deserialization process.

Consequently, an attacker possessing the signing key could create a valid session containing a specially crafted pickle object. When the OAuth callback processed this forged cookie, it would verify the signature, retrieve the attacker-controlled flow object, and then unpickle it, potentially leading to the execution of attacker-specified code on the server.

Simon Koeck’s proof of concept did not involve executing system commands on Google’s infrastructure. Instead, the researcher demonstrated the vulnerability using a benign time-delay payload. Requests containing the forged payload were observed to be delayed by the exact number of seconds specified in the serialized object, unequivocally proving that the server processed the manipulated data and executed the chosen Python function.

This vulnerability chain was particularly dangerous because it did not require a Google account to access the OAuth authorization endpoint and obtain the initial session cookie. Furthermore, its impact was amplified by affecting a shared platform rather than an isolated site, thereby broadening its potential reach across numerous Google developer web properties.

Google’s prompt response and significant reward underscore the high priority given to critical cloud code-execution issues. Similar high-stakes cases include a separate 2026 incident where Google addressed a CVSS 10.0 Application Integration flaw that also enabled RCE in production environments.

The DevSite vulnerability was a confluence of several poor design choices: first, sensitive OAuth material was stored in a client-side cookie; second, the exposed OAuth secret was improperly reused as the Flask signing secret; and third, the application deserialized session-controlled data using pickle, which becomes unsafe once an attacker can bypass integrity checks.

Simon Koeck confirmed that Google’s remediation efforts included rotating the compromised OAuth client secrets, invalidating all sessions signed with them, establishing distinct Flask SECRET_KEY values separate from OAuth credentials, and migrating OAuth flow objects to server-side storage for enhanced security.

The recommended secure design paradigm involves browser cookies carrying only opaque session references, while all sensitive state information resides securely on the server. Developers should also eliminate the use of pickle in any data paths that can be influenced by browsers, users, partner integrations, or external systems. Utilizing data-only formats like JSON, coupled with rigorous schema validation, is crucial to prevent deserialization vulnerabilities from escalating into code execution.

What You Should Do

• Developers should review their applications to ensure that sensitive data, especially signing keys and authentication credentials, are never exposed in client-side cookies or reused for multiple security functions.
• Implement server-side session management where sensitive state information is stored on the server, and only an opaque session identifier is sent to the client.
• Avoid using Python’s pickle module for deserializing untrusted or potentially attacker-controlled data. Opt for safer data serialization formats like JSON, YAML, or Protocol Buffers, combined with strict schema validation.
• Regularly audit and rotate all cryptographic keys and secrets used in your applications.
• Stay informed about best practices for secure application development, particularly concerning session management and data serialization.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.