Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Google Cloud Platform Remote Code Execution Vulnerability in GCP Composer

Critical
← View More Research Advisories

Synopsis

Tenable Research has discovered a Remote Code Execution (RCE) vulnerability in Google Cloud Platform (GCP) Composer. This flaw allowed attackers to execute arbitrary code on GCP servers, leading to potentially widespread impact.

 

The vulnerability stemmed from GCP Composer's dependency installation process. This vulnerability would have allowed attackers to upload a malicious package to PyPI, which would then be preinstalled on all Composer instances with high permissions.

 

Attackers could execute code, exfiltrate service account credentials, and move laterally to other GCP services. 

 

Tenable reported this vulnerability to Google VRP as Remote Code Execution. Google acknowledged this issue as remote server-side code execution in normal Google applications.

 

GCP confirmed the issue was fixed on April 22, 2024.

Solution

The vulnerability was remediated by fixing the script that includes dependencies to be downloaded and installed, and Google can verify that the package is only installed from a private repository. Google also verified the checksum of that package to verify its integrity as an extra precaution. 

 

In each released version of Airflow in Cloud Composer, Google verified the package checksum to ensure that the vulnerability had not been exploited and no users were impacted.

 

Additionally, Google took steps to educate customers and help them avoid making similar mistakes by updating documentation regarding Python dependencies in GCP services (see additional references).

Additional References

https://cloud.google.com/composer/docs/how-to/using/installing-python-dependencies
https://cloud.google.com/composer/docs/composer-2/install-python-dependencies
https://cloud.google.com/functions/docs/writing/specifying-dependencies-python
https://cloud.google.com/appengine/docs/standard/python3/specifying-dependencies

Disclosure Timeline

January 18, 2024 - Tenable discloses to GCP. Automated acknowledgment from GCP.
January 19, 2024 - Formal acknowledgment from GCP that the issue is being triaged.
January 22, 2024 - GCP confirms reported behavior.
January 25, 2024 - GCP states that reported issue does not meet severity standards.
January 28, 2024 - Tenable disputes GCP's evaluation of issue.
February 4, 2024 - GCP states that issue is being reviewed again.
Febuary 19, 2024 - Tenable requests status update.
Febuary 25, 2024 - Tenable requests status update.
Febuary 27, 2024 - GCP states issue is still in progress.
Febuary 28, 2024 - Tenable requests more information regarding the issues severity evaluation.
March 4, 2024 - GCP requests clarification.
March 4, 2024 - Tenable provides clarification.
March 5, 2024 - GCP acknowledges.
March 5, 2024 - Tenable requests status update from VRP.
March 6, 2024 - GCP acknowledges and states bounty/severity are still in review.
March 26, 2024 - GCP awards bounty to researcher.
March 26, 2024 - Tenable acknowledges.
March 27, 2024 - Tenable requests further information to include in advisory/publication.
March 28, 2024 - GCP acknowledges and states information has been requested. Tenable acknowledges.
April 4, 2024 - GCP provides status update.
April 22, 2024 - GCP provides requested information from March 27.
April 24, 2024 - Tenable responds with follow up questions regarding the extent of impact, and inquiring about fix timeline.
April 30, 2024 - GCP responds confirming fix, providing information on extent of potential impact and additional precautionary steps taken
May 12, 2024 - Tenable responds asking to confirm that the vulnerability is fully fixed, and validating there are no additional steps that should be taken before public disclosure.
May 21, 2024 - GCP responds with a thorough explanation of the fix and precautionary steps taken
June 3, 2024 - Public disclosure issued

All information within TRA advisories is provided “as is”, without warranty of any kind, including the implied warranties of merchantability and fitness for a particular purpose, and with no guarantee of completeness, accuracy, or timeliness. Individuals and organizations are responsible for assessing the impact of any actual or potential security vulnerability.

Tenable takes product security very seriously. If you believe you have found a vulnerability in one of our products, we ask that you please work with us to quickly resolve it in order to protect customers. Tenable believes in responding quickly to such reports, maintaining communication with researchers, and providing a solution in short order.

For more details on submitting vulnerability information, please see our Vulnerability Reporting Guidelines page.

If you have questions or corrections about this advisory, please email [email protected]

Risk Information

Tenable Advisory ID: TRA-2024-18
Credit:
Liv Matan
Affected Products:
GCP Composer
Risk Factor:
Critical

Advisory Timeline

June 3, 2024 - Limited advisory released
Try for Free Buy Now

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Tenable Vulnerability Management trials created everywhere except UAE will also include Tenable Lumin and Tenable Web App Scanning.

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

100 assets

Choose Your Subscription Option:

Buy Now
Try for Free Buy Now

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Tenable Vulnerability Management trials created everywhere except UAE will also include Tenable Lumin and Tenable Web App Scanning.

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

100 assets

Choose Your Subscription Option:

Buy Now
Try for Free Buy Now

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Tenable Vulnerability Management trials created everywhere except UAE will also include Tenable Lumin and Tenable Web App Scanning.

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

100 assets

Choose Your Subscription Option:

Buy Now
Try for Free Buy Now

Try Tenable Web App Scanning

Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable One Exposure Management platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. Sign up now.

Your Tenable Web App Scanning trial also includes Tenable Vulnerability Management and Tenable Lumin.

Buy Tenable Web App Scanning

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

5 FQDNs

$3,578

Buy Now

Try for Free Contact Sales

Try Tenable Lumin

Visualize and explore your exposure management, track risk reduction over time and benchmark against your peers with Tenable Lumin.

Your Tenable Lumin trial also includes Tenable Vulnerability Management and Tenable Web App Scanning.

Buy Tenable Lumin

Contact a Sales Representative to see how Tenable Lumin can help you gain insight across your entire organization and manage cyber risk.

Try for Free Buy Now

Try Tenable Nessus Professional Free

FREE FOR 7 DAYS

Tenable Nessus is the most comprehensive vulnerability scanner on the market today.

NEW - Tenable Nessus Expert
Now Available

Nessus Expert adds even more features, including external attack surface scanning, and the ability to add domains and scan cloud infrastructure. Click here to Try Nessus Expert.

Fill out the form below to continue with a Nessus Pro Trial.

Buy Tenable Nessus Professional

Tenable Nessus is the most comprehensive vulnerability scanner on the market today. Tenable Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy a multi-year license and save. Add Advanced Support for access to phone, community and chat support 24 hours a day, 365 days a year.

Select Your License

Buy a multi-year license and save.

Add Support and Training

Buy Now
Renew an existing license | Find a reseller
Try for Free Buy Now

Try Tenable Nessus Expert Free

FREE FOR 7 DAYS

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

Already have Tenable Nessus Professional?
Upgrade to Nessus Expert free for 7 days.

Buy Tenable Nessus Expert

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

Select Your License

Buy a multi-year license and save more.

Add Support and Training

Buy Now
Renew an existing license | Find a reseller