Researchers uncovered a vulnerability that could have placed millions of Google Cloud instances at risk of remote hijack.
The team with Tenable Research said that the flaw, dubbed “CloudImposer,” would allow a remote attacker to execute code on a cloud server without the need for any authentication or access rights.
Should an attacker exploit the vulnerability, they could create poisoned cloud instances that would set the stage for a supply chain attack in which a service provider is compromised in order to attack numerous customers that rely on a single service.
Tenable researcher Liv Matan explained that the bug is a result of dependency confusion error. In short, Google Cloud Platform (GCP) was not properly checking the bundled services that were preloaded when a new cloud instance was spun up.
This meant that an attacker could have potentially pointed a new cloud server towards a malicious library and then created thousands of poisoned cloud instances.
While Google has since addressed the flaw, Matan lamented that such vulnerabilities are nothing new and could likely impact other vendors.
“The affected GCP services are App Engine, Cloud Function, and Cloud Composer,” Matan wrote.
“This research shows that although the dependency confusion attack technique was discovered several years ago, there’s a surprising and concerning lack of awareness about it and about how to prevent it even among leading tech vendors like Google.”
The bug was not given a CVE designation. In general, cloud vulnerabilities tend not to get CVE numbers as they do not operate in the realm of locally installed software.
While the vulnerability itself is bad enough, Tenable said that Google did not help its own case with its documentation on the matter. Researchers found that the company’s own guidance for administrators included instructions that could have created the conditions for an attack on the vulnerability.
“We can infer that as for today, there are numerous GCP customers who followed this guidance, and use this argument when installing private packages in the affected services,” said Matan.
“These customers are at the risk of dependency confusion, and attackers might execute code on their environment.”
