A critical remote code execution (RCE) vulnerability, termed CloudImposer, which was recently discovered by the Tenable Research team could have allowed malicious attackers to execute code on potentially millions of Google Cloud Platform (GCP) servers and their customers’ systems. This vulnerability apparently highlights a significant security gap in Google Cloud services, specifically impacting App Engine, Cloud Function, and Cloud Composer.
The discovery stems from an in-depth analysis of documentation from both Google Cloud Platform and the Python Software Foundation, revealing that these services were vulnerable to a supply chain attack known as dependency confusion, said a statement from Tenable. While this attack technique has been known for several years, Tenable’s research shows a startling lack of awareness and preventive measures against it, even among major tech providers like Google.
Significance of Google Cloud Platform Vulnerability
Supply chain attacks in the cloud can be exponentially more damaging than on-premises environments. A single malicious package in a cloud service can spread across vast networks, impacting millions of users. The CloudImposer vulnerability demonstrates the far-reaching consequences of such attacks, emphasising the critical need for both cloud providers and customers to implement robust security measures.
“The blast radius of CloudImposer is immense. By discovering and disclosing this vulnerability, we’ve closed a major door that attackers could have exploited on a massive scale,” said Liv Matan, senior research engineer, at Tenable. “Sharing this research raises awareness and deepens the understanding of these kinds of vulnerabilities, increasing the likelihood of them being patched or discovered sooner; second, it highlights broader concepts that cloud users should be aware of to defend against similar risks and the expanding attack surface. This research empowers the security community and offensive professionals to identify similar vulnerabilities and misconfigurations.”
Lessons Learnt from Google Cloud Platform Vulnerability
Cloud security requires a collaborative effort between providers and customers. Tenable says that there is a need for cloud users to analyse their environments and review their package installation processes, particularly the –extra-index-url argument in Python, to mitigate risks of dependency confusion. Tenable claims that following its disclosure, Google has acknowledged and fixed the issue.
