News for hackers. Stuff that matters.

A comment on $36k Google App Engine RCE. Parent comment

Re:$36k Google App Engine RCE by tejasmanohar on Monday May 21, 2018 @05:52PM (#17122160)
Source? Is there really no authentication around it?
[ Parent | on HN ]
Re:$36k Google App Engine RCE by sulam on Monday May 21, 2018 @06:36PM (#17122426)
He had read access to G3. Exfiltrating it all would have been hard, but he could have gotten a chunk of it for sure.
[ Parent | on HN ]
Re:$36k Google App Engine RCE by joatmon-snoo on Tuesday May 22, 2018 @01:34AM (#17123932)
You want the part of the write-up where it mentions he gets FILE_GOOGLE3_ACCESS.

I'm not sure what access that actually gives, but that email thread showing people getting +cc'd on the ticket speaks pretty obviously to the severity and magnitude of the problem.

(Am Googler.)

[ Parent | on HN ]