Git on GMO Flatt Security Research

Remote Command Execution in Google Cloud with Single Directory Deletion

Mon, 23 Mar 2026 00:00:00 +0000

Introduction

Hello, I’m RyotaK (@ryotkak ), a security engineer at GMO Flatt Security Inc.

A while ago, I participated in the Google Cloud VRP bugSWAT, a live hacking event organized by Google.

During this event, I discovered a remote command execution vulnerability in one of Google Cloud’s services. As the vulnerability has now been fixed, I would like to share the technical details in this article.

TL;DR

Google Cloud has a product called Looker, and this product has a feature to manage Git repositories.

Clone2Leak: Your Git Credentials Belong To Us

Sun, 26 Jan 2025 00:00:00 +0000

Introduction

Hello, I’m RyotaK ( @ryotkak ), a security engineer at GMO Flatt Security Inc.

In October 2024, I was hunting bugs for the GitHub Bug Bounty program. After investigating GitHub Enterprise Server for a while, I felt bored and decided to try to find bugs on GitHub Desktop instead.

After reading the source code of GitHub Desktop, I found a bug that allows a malicious repository to leak the user’s credentials.
Since the concept of the bug is interesting, I decided to investigate other Git-related projects and found many bugs.