Saturday, April 13, 2024

Critical Google Cloud’s SQL Service Flaw Exposes Sensitive Data

Google recently fixed a critical Cloud SQL database service flaw that could have been exploited to access sensitive data and breach other cloud services.

On May 25th, Dig Security researchers uncovered this security gap in the CloudSQL service of GCP, enabling unauthorized access to various database engines like:- 

  • MySQL
  • PostgreSQL
  • SQL Server

Google Cloud’s SQL Service Flaw

Dig Security’s Ofrir Balassiano and Ofrir Shaty disclosed that:- 

“Exploiting the vulnerability granted them the ability to elevate privileges and assign a user to the highly privileged DbRootRole role in GCP.”

Leveraging a critical misconfiguration in the roles-permissions architecture, they escalated their privileges.

They obtained a system administrator role, granting them complete control over the SQL Server and enabling access to the underlying operating system.

Google Cloud's SQL Service Flaw
Db Role

The researchers affirmed that they gained the ability to retrieve sensitive files, view privileged paths, extract passwords, and access secrets from the host operating system.

They also highlighted the potential for further escalation to other environments through the underlying service agents.

Google Cloud's SQL Service Flaw

While apart from this, Dig Security discovered the flaw in Google’s Cloud SQL database service in February and notified Google. 

After they had been notified, Google promptly fixed the issue in April and rewarded Dig Security researchers a bug bounty reward under their bug bounty program.

In addition, security analysts also discovered another crucial flaw within the permission structure, allowing them to elevate privileges and grant their users the coveted ‘sysadmin’ role.

Google Cloud's SQL Service Flaw
Escalation of a user rule

Unauthorized access to internal data such as secrets, URLs, and passwords poses a significant security risk, as demonstrated by their ability to obtain sensitive information from Google’s docker image repository before the issue was resolved and non-internal IP access was restricted.

Research Timelines

Here below, we have mentioned the complete research timelines:-

  • February 5th, 2023: GCP CloudSQL vulnerability discovered by Dig’s research team.
  • February 13th, 2023: Google’s vulnerability reward program identified activity and contacted Dig’s research team.
  • During April 2023: The vulnerability was successfully addressed and resolved. 
  • April 25, 2023: Experts were rewarded by the GCP VRP program.

Deploying a Data Security and Privacy Management (DSPM) solution can safeguard organizations from vulnerabilities by identifying and protecting their most sensitive data through encryption, containing potential breaches, and minimizing exposure.


Latest articles

Alert! Palo Alto RCE Zero-day Vulnerability Actively Exploited in the Wild

In a recent security bulletin, Palo Alto Networks disclosed a critical vulnerability in its...

6-year-old Lighttpd Flaw Impacts Intel And Lenovo Servers

The software supply chain is filled with various challenges, such as untracked security vulnerabilities...

Hackers Employ Deepfake Technology To Impersonate as LastPass CEO

A LastPass employee recently became the target of an attempted fraud involving sophisticated audio...

Sisence Data Breach, CISA Urges To Reset Login Credentials

In response to a recent data breach at Sisense, a provider of data analytics...

DuckDuckGo Launches Privacy Pro: 3-in-1 service With VPN

DuckDuckGo has launched Privacy Pro, a new subscription service that promises to enhance user...

Cyber Attack Surge by 28%:Education Sector at High Risk

In Q1 2024, Check Point Research (CPR) witnessed a notable increase in the average...

Midnight Blizzard’s Microsoft Corporate Email Hack Threatens Federal Agencies: CISA Warns

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive concerning a...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Top 3 SME Attack Vectors

Securing the Top 3 SME Attack Vectors

Cybercriminals are laying siege to small-to-medium enterprises (SMEs) across sectors. 73% of SMEs know they were breached in 2023. The real rate could be closer to 100%.

  • Stolen credentials
  • Phishing
  • Exploitation of vulnerabilities

Related Articles