Google recently fixed a critical Cloud SQL database service flaw that could have been exploited to access sensitive data and breach other cloud services.
On May 25th, Dig Security researchers uncovered this security gap in the CloudSQL service of GCP, enabling unauthorized access to various database engines like:-
- MySQL
- PostgreSQL
- SQL Server
Google Cloud’s SQL Service Flaw
Dig Security’s Ofrir Balassiano and Ofrir Shaty disclosed that:-
“Exploiting the vulnerability granted them the ability to elevate privileges and assign a user to the highly privileged DbRootRole role in GCP.”
Leveraging a critical misconfiguration in the roles-permissions architecture, they escalated their privileges.
They obtained a system administrator role, granting them complete control over the SQL Server and enabling access to the underlying operating system.
The researchers affirmed that they gained the ability to retrieve sensitive files, view privileged paths, extract passwords, and access secrets from the host operating system.
They also highlighted the potential for further escalation to other environments through the underlying service agents.
While apart from this, Dig Security discovered the flaw in Google’s Cloud SQL database service in February and notified Google.
After they had been notified, Google promptly fixed the issue in April and rewarded Dig Security researchers a bug bounty reward under their bug bounty program.
In addition, security analysts also discovered another crucial flaw within the permission structure, allowing them to elevate privileges and grant their users the coveted ‘sysadmin’ role.
Unauthorized access to internal data such as secrets, URLs, and passwords poses a significant security risk, as demonstrated by their ability to obtain sensitive information from Google’s docker image repository before the issue was resolved and non-internal IP access was restricted.
Research Timelines
Here below, we have mentioned the complete research timelines:-
- February 5th, 2023: GCP CloudSQL vulnerability discovered by Dig’s research team.
- February 13th, 2023: Google’s vulnerability reward program identified activity and contacted Dig’s research team.
- During April 2023: The vulnerability was successfully addressed and resolved.
- April 25, 2023: Experts were rewarded by the GCP VRP program.
Deploying a Data Security and Privacy Management (DSPM) solution can safeguard organizations from vulnerabilities by identifying and protecting their most sensitive data through encryption, containing potential breaches, and minimizing exposure.
