News for hackers. Stuff that matters.
Re:$36k Google App Engine RCE by dnr on Tuesday May 22, 2018 @01:59PM (#17128007)
That's probably not quite true. "google3 file access" most likely means the ability to open paths with the "google3 file library", which lets you use paths like "/gfs/<cluster>/...", and similar for all the different storage services. But you'd also need an identity with permissions to read whatever you're reading. Without an identity that's in ACLs and stuff, you'd only be able to see "world-readable" data, which is still quite serious because who knows what's lying around, but probably nothing sensitive like source code.

There are no comments on this comment yet.