# Remote Code Execution Vulnerability in Google They Are Not Willing To Fix

Researcher found a private Google Python package name via GitHub scanning, uploaded a same-named PyPI package, and it was installed on 50+ Googler hosts, enabling RCE.

- Payout: $500
- Severity: high
- Program: Google
- Credited: Giraffe Security
- Disclosed: 2023-04-14
- Write-up quality: 7/10
- Original: https://giraffesecurity.dev/posts/google-remote-code-execution/
- Library page: https://bugbountylibrary.com/r/blog%3Agiraffesecurity-dev-posts-google-remote-code-execution
- Tags: domain:oss impact:internal-access impact:rce kind:bounty platform:blog sev:high tech:python technique:recon technique:source-review vuln:dependency-confusion

**Target:** Internal Python package (package X) installed via pip from PyPI
**Root cause:** Google's internal pip install used extra-index-url, so a public PyPI package with the same name as a private package was resolved and installed, executing its install-time code.
**Steps:**
1. Scan GitHub repos of Google orgs/employees for dependency lists (e.g. pip freeze output) referencing package names absent from PyPI
2. Identify package X referenced in a requirements.txt across multiple Googler repos
3. Upload a public PyPI package named package X whose setup install script sends hostname and username to attacker server
4. Wait ~2 weeks; observe downloads from Googler hosts at ~1/day
5. Report to Google VRP; bug classified S0 and fixed in ~2 weeks
6. After patch, downloads resumed; second report closed as working-as-intended
**How found:** Hypothesis that private package names leak in public code bundles and dependency files. Built a scanner over GitHub repos owned by big-tech orgs and employees, looking for dependency entries with no matching public package. A hit in a Googler's requirements.txt plus three more Googler references confirmed ownership.
**Exploitation:** Attacker claims the private package name on public PyPI; any pip install resolving via extra-index-url pulls the malicious package and runs its install-time code, giving arbitrary code execution on the installing host. Researcher only exfiltrated hostname/username to confirm; could have swapped in malicious payload.
**Escalation:** Downloads came from 50+ unique Googler hosts across roles and countries, including corp and cloudtop machines, indicating broad internal exposure beyond a single build system.
**Insight:** Private package names leak in requirements.txt/pip freeze output and front-end bundles; scan org and employee GitHub repos for dependency entries absent from the public registry, then claim the name and beacon hostname/username at install time to confirm.