Remote Command Execution in Google Cloud with Single Directory Deletion

Mon, 23 Mar 2026 00:00:00 +0000

Introduction

Hello, I’m RyotaK (@ryotkak ), a security engineer at GMO Flatt Security Inc.

A while ago, I participated in the Google Cloud VRP bugSWAT, a live hacking event organized by Google.

During this event, I discovered a remote command execution vulnerability in one of Google Cloud’s services. As the vulnerability has now been fixed, I would like to share the technical details in this article.

TL;DR

Google Cloud has a product called Looker, and this product has a feature to manage Git repositories.

Beyond the Limit: Expanding single-packet race condition with a first sequence sync for breaking the 65,535 byte limit

Fri, 02 Aug 2024 00:00:00 +0000

Introduction

Hello, I’m RyotaK (@ryotkak ), a security engineer at Flatt Security Inc.

In 2023, James Kettle of PortSwigger published an excellent paper titled Smashing the state machine: the true potential of web race conditions.
In the paper, he introduced a new attack technique called single-packet attack that can exploit a race condition without being affected by the network jitter.

Quoted from Smashing the state machine: the true potential of web race conditions

Recently, I encountered a limit-overrun type of race condition that requires sending approximately 10,000 requests simultaneously to exploit reliably, so I attempted to apply the single packet attack to it.
However, due to the single packet attack’s limitation, which restricts the maximum size of requests that can be sent to around 1,500 bytes, I couldn’t exploit the vulnerability.

Race Condition on GMO Flatt Security Research

Remote Command Execution in Google Cloud with Single Directory Deletion

Introduction

TL;DR

Beyond the Limit: Expanding single-packet race condition with a first sequence sync for breaking the 65,535 byte limit

Introduction