Thursday, June 13, 2024

Google Workspace’s Design Flaw Allows Attacker Unauthorized Access

Recent years saw a surge in cloud tech adoption, highlighting the efficiency through tools like Google’s Domain-Wide Delegation. 

It enables GCP (Google Cloud Platform) identities to perform tasks in GWS (Google Workspace) apps on behalf of Workspace users, streamlining work processes.

Cybersecurity researchers at Hunters’ Team Axon recently found a design flaw in Google Workspace’s Domain-Wide Delegation, which is dubbed as “DeleFriend.”

This flaw allows:-

  • Misuse
  • Privilege escalation
  • Unauthorized API access without Super Admin rights
Protect Your Storage With SafeGuard

Is Your Storage & Backup Systems Fully Protected? – Watch 40-second Tour of SafeGuard

StorageGuard scans, detects, and fixes security misconfigurations and vulnerabilities across hundreds of storage and backup devices.

DeleFriend Severe Design Flaw

Google Cloud and Workspace share a vital connection through Domain-Wide Delegation. While Google Cloud IAM handles internal resource control, Workspace is the central ‘hub’ for user management. 

The integrated identity concept is key, whether through Workspace or Cloud Identity, even for organizations using third-party IdP like Okta or Azure AD for GCP services.

Google's IDaaS concept (Source - Hunters)
Google’s IDaaS concept (Source – Hunters)

Google Workspace’s Domain-Wide Delegation streamlines app access to Workspace data and helps boost efficiency. 

With OAuth 2.0, developers grant service accounts user data access without individual consent, which:-

  • Reduces the errors
  • Automates the tasks

Here below, we have mentioned the types of main global delegated object identities that Google Workspace allows to create:-

  • GWS Applications
  • GCP Service Account

Google adopts OAuth 2.0 RFC 6749 for delegated authorization, mirroring other cloud providers. This allows identities to grant permissions to Workspace REST API apps without exposing credentials.

However, besides this, the researchers demonstrated the flaw with the help of two scenarios, and here below, we have mentioned those scenarios:-

  • Scenario 1 – New delegation with interactive GWS access: In this scenario, the threat actor gains initial IAM access, creates GCP service accounts, earns GWS super admin privilege, and seeks robust persistence and exfiltration options.
  • Scenario 2 – DeleFriend – Compromise existing delegation: In this scenario, in an effort to go from restricted GCP rights to Workspace without requiring Super Admin power, the security researchers investigate the GWS delegation misuse with lesser privileges.

Advantages of this Attack Vector

Here below, we have mentioned all the advantages that this attack vector brings to the threat actors:-

  • Powerful impact
  • Long life
  • Easy to hide
  • Awareness
  • Hard to detect

Mitigation Recommendations

Here below we have mentioned all the mitigation recommendations that the cybersecurity researchers recommend:-

  • Configuration is based on the entire Service Account instead of a private key.
  • Block JWT enumeration on API level.
  • Over-permissive permission to the Editor role.
  • Identify Delegated OAuth Requests to Google APIs.
  • Make sure to review all the query results.
  • All the inactive delegations that are outlined in the query results must be evaluated.
  • The private keys of the found GCP service accounts must be examined properly.
  • Check OAuth scopes if delegation is as expected but unused.

Experience how StorageGuard eliminates the security blind spots in your storage systems by trying a 14-day free trial.


Latest articles

CISA Warns of Scammers Impersonating as CISA Employees

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about a surge...

Microsoft Windows Ntqueryinformationtoken Flaw Let Attackers Escalate Privileges

Microsoft has disclosed a critical vulnerability identified as CVE-2024-30088.With a CVSS score of 8.8, this flaw affects Microsoft...

256,000+ Publicly Exposed Windows Servers Vulnerable to MSMQ RCE Flaw

Cybersecurity watchdog Shadowserver has identified 256,000+ publicly exposed servers vulnerable to a critical Remote...

Indian National Jailed For Hacked Servers Of Company That Fired Him

An Indian national was sentenced to two years and eight months in jail for...

JetBrains Warns of GitHub Plugin that Exposes Access Tokens

A critical vulnerability (CVE-2024-37051) in the JetBrains GitHub plugin for IntelliJ-based IDEs (2023.1 and...

Critical Flaw In Apple Ecosystems Let Attackers Gain Unauthorized Access

Hackers go for Apple due to its massive user base along with rich customers,...

Hackers Exploiting Linux SSH Services to Deploy Malware

SSH and RDP provide remote access to server machines (Linux and Windows respectively) for...
Tushar Subhra Dutta
Tushar Subhra Dutta
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles