A brand new safety flaw has been disclosed within the Google Cloud Platform’s (GCP) Cloud SQL service that could possibly be probably exploited to acquire entry to confidential information.
“The vulnerability may have enabled a malicious actor to escalate from a primary Cloud SQL consumer to a full-fledged sysadmin on a container, getting access to inside GCP information like secrets and techniques, delicate recordsdata, passwords, along with buyer information,” Israeli cloud safety agency Dig stated.
Cloud SQL is a fully-managed answer to construct MySQL, PostgreSQL, and SQL Server databases for cloud-based functions.
The multi-stage assault chain recognized by Dig, in a nutshell, leveraged a niche within the cloud platform’s safety layer related to SQL Server to escalate the privileges of a consumer to that of an administrator position.
The elevated permissions subsequently made it attainable to abuse one other crucial misconfiguration to acquire system administrator rights and take full management of the database server.
From there, a menace actor may entry all recordsdata hosted on the underlying working system, enumerate recordsdata, and extract passwords, which may then act as a launchpad for additional assaults.
“Getting access to inside information like secrets and techniques, URLs, and passwords can result in publicity of cloud suppliers’ information and prospects’ delicate information which is a serious safety incident,” Dig researchers Ofir Balassiano and Ofir Shaty stated.
Zero Belief + Deception: Be taught Find out how to Outsmart Attackers!
Uncover how Deception can detect superior threats, cease lateral motion, and improve your Zero Belief technique. Be a part of our insightful webinar!
Following accountable disclosure in February 2023, the difficulty was addressed by Google in April 2023.
The disclosure comes as Google introduced the provision of its Automated Certificates Administration Atmosphere (ACME) API for all Google Cloud customers to routinely purchase and renew TLS certificates without cost.