Finding a $90,000 Remote Code Execution Vulnerability in Google

发生了什么

A Flask cookie on developers.google.com was signed with a secret it was also carrying inside itself. Pulling that secret out turned a forged session into code execution across seven Google domains.

摘要按规则整理自下方来源原文

时间线

1. 07:28
   Hacker News 最先出现HHacker News
2. 14:40
   Lobsters 出现讨论LLobsters

来源