Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Google Cloud Platform Remote Code Execution Vulnerability in GCP Composer

Critical

Synopsis

Tenable Research has discovered a Remote Code Execution (RCE) vulnerability in Google Cloud Platform (GCP) Composer. This flaw allowed attackers to execute arbitrary code on GCP servers, leading to potentially widespread impact.

 

The vulnerability stemmed from GCP Composer's dependency installation process. This vulnerability would have allowed attackers to upload a malicious package to PyPI, which would then be preinstalled on all Composer instances with high permissions.

 

Attackers could execute code, exfiltrate service account credentials, and move laterally to other GCP services. 

 

Tenable reported this vulnerability to Google VRP as Remote Code Execution. Google acknowledged this issue as remote server-side code execution in normal Google applications.

 

GCP confirmed the issue was fixed on April 22, 2024.

Solution

The vulnerability was remediated by fixing the script that includes dependencies to be downloaded and installed, and Google can verify that the package is only installed from a private repository. Google also verified the checksum of that package to verify its integrity as an extra precaution. 

 

In each released version of Airflow in Cloud Composer, Google verified the package checksum to ensure that the vulnerability had not been exploited and no users were impacted.

 

Additionally, Google took steps to educate customers and help them avoid making similar mistakes by updating documentation regarding Python dependencies in GCP services (see additional references).

Disclosure Timeline

January 18, 2024 - Tenable discloses to GCP. Automated acknowledgment from GCP.
January 19, 2024 - Formal acknowledgment from GCP that the issue is being triaged.
January 22, 2024 - GCP confirms reported behavior.
January 25, 2024 - GCP states that reported issue does not meet severity standards.
January 28, 2024 - Tenable disputes GCP's evaluation of issue.
February 4, 2024 - GCP states that issue is being reviewed again.
Febuary 19, 2024 - Tenable requests status update.
Febuary 25, 2024 - Tenable requests status update.
Febuary 27, 2024 - GCP states issue is still in progress.
Febuary 28, 2024 - Tenable requests more information regarding the issues severity evaluation.
March 4, 2024 - GCP requests clarification.
March 4, 2024 - Tenable provides clarification.
March 5, 2024 - GCP acknowledges.
March 5, 2024 - Tenable requests status update from VRP.
March 6, 2024 - GCP acknowledges and states bounty/severity are still in review.
March 26, 2024 - GCP awards bounty to researcher.
March 26, 2024 - Tenable acknowledges.
March 27, 2024 - Tenable requests further information to include in advisory/publication.
March 28, 2024 - GCP acknowledges and states information has been requested. Tenable acknowledges.
April 4, 2024 - GCP provides status update.
April 22, 2024 - GCP provides requested information from March 27.
April 24, 2024 - Tenable responds with follow up questions regarding the extent of impact, and inquiring about fix timeline.
April 30, 2024 - GCP responds confirming fix, providing information on extent of potential impact and additional precautionary steps taken
May 12, 2024 - Tenable responds asking to confirm that the vulnerability is fully fixed, and validating there are no additional steps that should be taken before public disclosure.
May 21, 2024 - GCP responds with a thorough explanation of the fix and precautionary steps taken
June 3, 2024 - Public disclosure issued

All information within TRA advisories is provided “as is”, without warranty of any kind, including the implied warranties of merchantability and fitness for a particular purpose, and with no guarantee of completeness, accuracy, or timeliness. Individuals and organizations are responsible for assessing the impact of any actual or potential security vulnerability.

Tenable takes product security very seriously. If you believe you have found a vulnerability in one of our products, we ask that you please work with us to quickly resolve it in order to protect customers. Tenable believes in responding quickly to such reports, maintaining communication with researchers, and providing a solution in short order.

For more details on submitting vulnerability information, please see our Vulnerability Reporting Guidelines page.

If you have questions or corrections about this advisory, please email [email protected]

Risk Information

Tenable Advisory ID: TRA-2024-18
Credit:
Liv Matan
Affected Products:
GCP Composer
Risk Factor:
Critical

Advisory Timeline

June 3, 2024 - Limited advisory released