alt Hacker News"This vulnerability is probably a good example of something with a sub-$1000 value on any non-bounty market."
Crazy statement. This would easily be worth more to malicious actors
"This vulnerability is probably a good example of something with a sub-$1000 value on any non-bounty market."
Crazy statement. This would easily be worth more to malicious actors
The only actors who will pay you real money for a serverside RCE bug aren't buying an exploit; they're contracting with you to plan a heist. So the same analysis applies: you yourself could come up with some scheme whereby you yourself use this vulnerability to steal stuff from Google. But that's not what we're talking about when we talk about vulnerability valuations.
There is essentially no market for these kinds of serverside vulnerabilities.