Tenable’s research team has discovered a critical remote code execution (RCE) vulnerability, dubbed CloudImposer, that could have allowed malicious attackers to execute code on potentially millions of Google Cloud Platform (GCP) servers and their customer’s systems.
The company says the vulnerability highlights a significant security gap in Google Cloud services that specifically impacts App Engine, Cloud Function, and Cloud Composer.
The discovery stems from an in-depth analysis of documentation from both GCP and the Python Software Foundation, revealing that these services were vulnerable to a supply chain attack known as dependency confusion. While this attack technique has been known for several years, Tenable’s research shows a startling lack of awareness and preventive measures against it, even among major tech providers like Google.
Why does it matter? Supply chain attacks in the cloud can be exponentially more damaging than on-premises environments. A single malicious package in a cloud service can spread across vast networks, impacting millions of users. The CloudImposer vulnerability demonstrates the far-reaching consequences of such attacks, emphasising the critical need for both cloud providers and customers to implement robust security measures.
“The blast radius of CloudImposer is immense,” said Liv Matan, a senior research engineer at Tenable. “By discovering and disclosing this vulnerability, we’ve closed a major door that attackers could have exploited on a massive scale. Sharing this research raises awareness and deepens the understanding of these kinds of vulnerabilities, increasing the likelihood of them being patched or discovered sooner. Secondly, it highlights broader concepts that cloud users should be aware of to defend against similar risks and the expanding attack surface. This research empowers the security community and offensive professionals to identify similar vulnerabilities and misconfigurations.”
Tenable says cloud security requires a collaborative effort between providers and customers. The company urges cloud users to analyse their environments and review their package installation processes, particularly the extra-index-url argument in Python, to mitigate risks of dependency confusion.
Following Tenable’s disclosure, Google has acknowledged and fixed the issue.
