$6,000 seems low for such a severe bug across almost all Google web properties. I would expect an order of magnitude larger.
https://www.google.com/about/appsecurity/reward-program/inde...
I guess they were awarded $6K instead of the full because they didn't demonstrate it against more substantial properties. But either way the ceiling is quite low on these classes of vulnerabilities.
I'm curious to know, but I'd think that the author would've tried to also exploit it in those other apps, and the fact that it's not documented here may be because they didn't find any issues with the other ones? It's a pretty generic regex that has many uses, and may be used for other stuff in other places.
(The work is important! But people who find web bugs like this tend to make their money on volume, not on a couple major hits a year, like the RCE researchers do.)
No they’re not. Just because this happened to be a URL whitelist bug doesn’t mean that this is the primary work that the researcher who found the bug does. Did a URL whitelist validation researcher find this, or did someone researching user auth access find this bug? If Google knew exactly who they wanted to find this bug, then Google would have already found it themselves.
Who Google and other service providers are competing against are grayweb exploit dealers. That's the real market, and every popular site, api, and program is subject, regardless if they're on H1 or not.
Sure there's some whitehat types who'd only tell the companies directly. But the rest.... Well.
And again, it's not a status thing. You can probably make quite a lot of money on bugs like this; you simply find a lot more of them than anyone generates RCE exploits.
The black hats. $6,000 from Google, or $600,000 from some shadowy company in UTC+02. Google makes these choices too easy.