Dig Security Uncovers Vulnerability in GCP CloudSQL Service Exposing Provider and Customer Data, Remediates Issues

Security flaw could have enabled bad actors to access sensitive data, including secrets, URLs and passwords

TEL AVIV, Israel, May 25, 2023 /PRNewswire/ -- Dig, the cloud data security leader, today released new threat research highlighting the discovery of a critical vulnerability in the Google Cloud Platform (GCP) CloudSQL service. The vulnerability could have enabled a malicious actor to escalate from a basic CloudSQL user to a full-fledged sysadmin on a container, gaining access to internal GCP data like secrets, sensitive files, passwords, in addition to customer data.

Dig's research team identified the vulnerability through a gap in GCP's security layer. This vulnerability enabled them to escalate initial privilege and add a user to the DbRootRole role, a GCP admin role. Another critical misconfiguration in the roles permissions architecture enabled Dig's researchers to further escalate their privilege, eventually granting their user the sysadmin role. They bypassed the barrier and got full control on the SQL Server.

Assuming complete control on the database engine, Dig's researchers gained access to the operating system hosting the database. At this point they could access sensitive files in the host OS, list files and sensitive paths, read passwords and extract secrets from the machine. The host also gained access to the underlying https://cloud.google.com/iam/docs/service-agents, which could be further escalated to other environments.

While the Dig research team got access to the operating system, they managed to find some of Google's internal URLs related to the docker image repository. They were able to access the internal repo (which has since been fixed, and access is blocked from non internal IPs).

Upon discovering the vulnerabilities, Dig's research team followed coordinated disclosure practices with Google, and all issues were remediated swiftly.

"Cloud data assets are the main target of today's cyberattacks," said Dan Benjamin, Co-Founder and CEO, Dig Security. "Data is the lifeblood of the modern enterprise, and GCP is one of the top public cloud providers. We chose to focus this threat research on CloudSQL because of its potential impact on customer data. We were proud to work closely with the Google team to patch the new security vulnerability swiftly and effectively."

You can read more about Dig's work identifying this security flaw here: https://www.dig.security/post/gcp-cloudsql-vulnerability-leads-to-internal-container-access-and-data-exposure.

Dig helps organizations discover, classify, protect, and govern their cloud data without giving up cloud agility and speed. It is easy-to-implement, cloud-scalable, and highly efficient for today's security teams.

About Dig Security
Dig Security helps organizations discover, classify, protect, and govern their cloud data. With organizations shifting to complex environments with dozens of database types across clouds, monitoring and detecting data exfiltration and policy violations has become a complex problem with limited fragmented solutions. Dig's cloud-native and completely agentless approach re-invents cloud DLP with DDR (Data Detection & Response) capabilities to help organizations better cope with cloud data sprawl. Dig was founded by three cyber security veterans from Microsoft and Google and is backed by Team8, SignalFire, Felicis, CrowdStrike, Okta Ventures, CyberArk Ventures, and Merlin Ventures. Visit us at https://www.dig.security/.

SOURCE Dig Security