Wednesday, December 6, 2023

Critical Google Cloud’s SQL Service Flaw Exposes Sensitive Data

Google recently fixed a critical Cloud SQL database service flaw that could have been exploited to access sensitive data and breach other cloud services.

On May 25th, Dig Security researchers uncovered this security gap in the CloudSQL service of GCP, enabling unauthorized access to various database engines like:- 

  • MySQL
  • PostgreSQL
  • SQL Server

Google Cloud’s SQL Service Flaw

Dig Security’s Ofrir Balassiano and Ofrir Shaty disclosed that:- 

“Exploiting the vulnerability granted them the ability to elevate privileges and assign a user to the highly privileged DbRootRole role in GCP.”

Leveraging a critical misconfiguration in the roles-permissions architecture, they escalated their privileges.

They obtained a system administrator role, granting them complete control over the SQL Server and enabling access to the underlying operating system.

Google Cloud's SQL Service Flaw
Db Role

The researchers affirmed that they gained the ability to retrieve sensitive files, view privileged paths, extract passwords, and access secrets from the host operating system.

They also highlighted the potential for further escalation to other environments through the underlying service agents.

Google Cloud's SQL Service Flaw

While apart from this, Dig Security discovered the flaw in Google’s Cloud SQL database service in February and notified Google. 

After they had been notified, Google promptly fixed the issue in April and rewarded Dig Security researchers a bug bounty reward under their bug bounty program.

In addition, security analysts also discovered another crucial flaw within the permission structure, allowing them to elevate privileges and grant their users the coveted ‘sysadmin’ role.

Google Cloud's SQL Service Flaw
Escalation of a user rule

Unauthorized access to internal data such as secrets, URLs, and passwords poses a significant security risk, as demonstrated by their ability to obtain sensitive information from Google’s docker image repository before the issue was resolved and non-internal IP access was restricted.

Research Timelines

Here below, we have mentioned the complete research timelines:-

  • February 5th, 2023: GCP CloudSQL vulnerability discovered by Dig’s research team.
  • February 13th, 2023: Google’s vulnerability reward program identified activity and contacted Dig’s research team.
  • During April 2023: The vulnerability was successfully addressed and resolved. 
  • April 25, 2023: Experts were rewarded by the GCP VRP program.

Deploying a Data Security and Privacy Management (DSPM) solution can safeguard organizations from vulnerabilities by identifying and protecting their most sensitive data through encryption, containing potential breaches, and minimizing exposure.


Latest articles

BlueNoroff: New Malware Attacking MacOS Users

Researchers have uncovered a new Trojan-attacking macOS user that is associated with the BlueNoroff APT...

Serpent Stealer Acquires Browser Passwords and Erases Intrusion Logs

Beneath the surface of the cyber realm, a silent menace emerges—crafted with the precision...

Doppelgänger: Hackers Employ AI to Launch Highly sophistication Attacks

It has been observed that threat actors are using AI technology to conduct illicit...

Kali Linux 2023.4 Released – What’s New!

Kali Linux 2023.4, the latest version of Offensive Security's renowned operating system, has been...

Trickbot Malware Developer Pleads Guilty & Faces 35 Years in Prison

A 40-year-old Russian national, Vladimir Dunaev, pleaded guilty for developing and deploying Trickbot malware....

ICANN Launches RDRS to Assist Law Enforcement Agencies to Discover Private Info

ICANN is a non-profit organization that is responsible for coordinating the global internet's-DNSIP address...

Hackers Use Weaponized Documents to Attack U.S. Aerospace Industry

An American aerospace company has been the target of a commercial cyberespionage campaign dubbed...

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles