Google Workspace’s Design Flaw Allows Attacker Unauthorized Access

Recent years saw a surge in cloud tech adoption, highlighting the efficiency through tools like Google’s Domain-Wide Delegation. 

It enables GCP (Google Cloud Platform) identities to perform tasks in GWS (Google Workspace) apps on behalf of Workspace users, streamlining work processes.

Cybersecurity researchers at Hunters’ Team Axon recently found a design flaw in Google Workspace’s Domain-Wide Delegation, which is dubbed as “DeleFriend.”

This flaw allows:-

  • Misuse
  • Privilege escalation
  • Unauthorized API access without Super Admin rights
Document
Protect Your Storage With SafeGuard

Is Your Storage & Backup Systems Fully Protected? – Watch 40-second Tour of SafeGuard

StorageGuard scans, detects, and fixes security misconfigurations and vulnerabilities across hundreds of storage and backup devices.

DeleFriend Severe Design Flaw

Google Cloud and Workspace share a vital connection through Domain-Wide Delegation. While Google Cloud IAM handles internal resource control, Workspace is the central ‘hub’ for user management. 

The integrated identity concept is key, whether through Workspace or Cloud Identity, even for organizations using third-party IdP like Okta or Azure AD for GCP services.

Google's IDaaS concept (Source - Hunters)Google's IDaaS concept (Source - Hunters)
Google’s IDaaS concept (Source – Hunters)

Google Workspace’s Domain-Wide Delegation streamlines app access to Workspace data and helps boost efficiency. 

With OAuth 2.0, developers grant service accounts user data access without individual consent, which:-

  • Reduces the errors
  • Automates the tasks

Here below, we have mentioned the types of main global delegated object identities that Google Workspace allows to create:-

  • GWS Applications
  • GCP Service Account

Google adopts OAuth 2.0 RFC 6749 for delegated authorization, mirroring other cloud providers. This allows identities to grant permissions to Workspace REST API apps without exposing credentials.

However, besides this, the researchers demonstrated the flaw with the help of two scenarios, and here below, we have mentioned those scenarios:-

  • Scenario 1 – New delegation with interactive GWS access: In this scenario, the threat actor gains initial IAM access, creates GCP service accounts, earns GWS super admin privilege, and seeks robust persistence and exfiltration options.
  • Scenario 2 – DeleFriend – Compromise existing delegation: In this scenario, in an effort to go from restricted GCP rights to Workspace without requiring Super Admin power, the security researchers investigate the GWS delegation misuse with lesser privileges.

Advantages of this Attack Vector

Here below, we have mentioned all the advantages that this attack vector brings to the threat actors:-

  • Powerful impact
  • Long life
  • Easy to hide
  • Awareness
  • Hard to detect

Mitigation Recommendations

Here below we have mentioned all the mitigation recommendations that the cybersecurity researchers recommend:-

  • Configuration is based on the entire Service Account instead of a private key.
  • Block JWT enumeration on API level.
  • Over-permissive permission to the Editor role.
  • Identify Delegated OAuth Requests to Google APIs.
  • Make sure to review all the query results.
  • All the inactive delegations that are outlined in the query results must be evaluated.
  • The private keys of the found GCP service accounts must be examined properly.
  • Check OAuth scopes if delegation is as expected but unused.

Experience how StorageGuard eliminates the security blind spots in your storage systems by trying a 14-day free trial.

Tushar Subhra

Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Recent Posts

Hackers Target Mobile Users Using PWA JavaScript to Bypass Browser Security

A sophisticated new injection campaign has been uncovered, targeting mobile users through malicious third-party JavaScript…

6 hours ago

Docker Zombie Malware Infects Containers for Crypto Mining and Self-Replication

A novel malware campaign targeting containerized infrastructures has emerged, exploiting insecurely exposed Docker APIs to…

7 hours ago

Hackers Masquerade as Organizations to Steal Payroll Logins and Redirect Payments from Employees

ReliaQuest, hackers have deployed a cunning search engine optimization (SEO) poisoning scheme to orchestrate payroll…

7 hours ago

PupkinStealer Exploits Web Browser Passwords and App Tokens to Exfiltrate Data Through Telegram

A newly identified .NET-based information-stealing malware, dubbed PupkinStealer (also known as PumpkinStealer in some reports),…

7 hours ago

71 Fake Websites Impersonating German Retailer to Steal Payment Information

Recorded Future Payment Fraud Intelligence has uncovered a sprawling network of 71 fraudulent e-commerce domains…

8 hours ago

New Scan Uncovers 150K Industrial Systems Worldwide Vulnerable to Cyberattacks

A groundbreaking study leveraging advanced application-layer scanning has exposed approximately 150,000 industrial control systems (ICS)…

8 hours ago