Home page logo
/

bugtraq logo Bugtraq mailing list archives

Google App Enging SDK Code Execution Vulnerability (CVE 2011-1364)
From: Adi Sharabani <adish () il ibm com>
Date: Tue, 11 Oct 2011 22:51:11 +0200


We recently identified an interesting code execution vulnerability in the
Google App Engine SDK for Python. By combining a CSRF vulnerability in the
administration web UI, with some other unique vulnerabilities we found in
the Google python libraries, a remote hacker could gain remote code
execution privileges on victim's machine. This vulnerability affects all
operation systems running Google App Engine SDK for python (i.e. Windows,
Mac OS, etc.).

Full advisory can be found at:

http://blog.watchfire.com/wfblog/2011/10/google-app-engine-cve-2011-1364.html


-Adish
Adi Sharabani
Security Strategist, Master Inventor, IBM


  By Date           By Thread  

Current thread:
  • Google App Enging SDK Code Execution Vulnerability (CVE 2011-1364) Adi Sharabani (Oct 12)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault