Google Cloud API bug leaks private project information

guest · Sep 3, 2020

Google Cloud API bug leaks private project information
The now-patched privacy flaw puts unsecured resources in jeopardy
September 3, 2020
https://portswigger.net/daily-swig/google-cloud-api-bug-leaks-private-project-information

Google has just fixed a bug in its cloud platform that made it possible for attackers to obtain a list of service accounts in a Google Cloud Platform (GCP) project.

The bug, found by security researcher Ezequiel Pereira, could potentially enable cybercriminals to gain access to unsecured resources.
Pagination error
Pereira found the security hole while probing GCP’s Identity and Access Management API (IAM API).
Among IAM API’s functions is the management of service accounts, special non-user Google accounts that give apps access to resources and functions.

The researcher further discovered that if he created a custom PageToken value with another project number, he could obtain a list of service accounts for that project, even if he didn’t have access to it.
Click to expand...

Unsecured resources at risk
Pereira also found a way to trick the Google authentication service into revealing project numbers, so that they could be fed into the IAM service account listing function.

“By listing per-product, per-project service accounts, I believe it would have been possible to gather a huge list of GCP project numbers, which could in turn be resolved into project IDs,” Pereira told The Daily Swig.
Click to expand...

In a blog post revisiting his discovery, Pereira confirmed that he has found another security issue that resolves project IDs from project numbers.

“This issue is in a different GCP API (not the IAM API), but it relies on using undocumented features, so I'd guess it is safe to assume it is unlikely for a real attacker to find it,” he said.
Click to expand...

Auth bypass: Leaking Google Cloud service accounts and projects

Service accounts are special Google accounts that can be used by programs, often used to perform actions in GCP such as managing resources or accessing information.

I honestly did not have high hopes of finding any security issues in the IAM API, since it is one of the most sensitive GCP services, a security issue in it could potentially lead to a compromise of most of Google Cloud resources, therefore everything would have probably undergone heavy security scrutiny. [...]
Click to expand...

Log in or Sign up

Google Cloud API bug leaks private project information

guest Guest

Log in or Sign up

Google Cloud API bug leaks private project information

guest Guest

Useful Searches