A Flask cookie that carried its own signing key led to remote code execution on Google

Flask session cookies are signed, not encrypted, so anyone with a cookie can see its contents. Because the signing key was inside the data it protected, an attacker could extract it, forge a signature, and then inject arbitrary pickle payloads that the server would deserialize, leading to code execution.

Google’s DevSite issued a Flask session cookie after an OAuth request. Thus the signing key traveled with the data it was supposed to protect.

While mapping the OAuth flow, Simon Koeck noticed the cookie was unusually large. Decoding it revealed the plaintext client_secret and the pickled flow object. By using the extracted secret as the Flask SECRET_KEY he could recompute a valid signature for any payload he chose.

Because the server verified the signature with the stolen secret, it accepted the cookie, extracted the pickled bytes and passed them to pickle.loads, which executed the embedded callable. The resulting delay in the response confirmed that the server had deserialized and executed the attacker‑supplied code.

If a system continues to bind its signing secret to the data it signs, the same reversal of trust will allow an attacker who can read the data to forge authentic‑looking tokens and reach any downstream sink that trusts the signature.