Synopsis
Tenable Research has identified and responsibly disclosed a safety mechanism bypass vulnerability in Google Security Operations. This flaw allowed an attacker to leak the access token of the highly privileged SIEM tenant service account, leading to a significant privilege escalation.
This vulnerability was rooted in the handling of API connections within Google Security Operations' job scheduler. When a scheduled job was configured with a custom integration, an attacker could manipulate the API root parameter to point to an external, attacker-controlled server.
By altering this parameter, the attacker could force the system to use a different code path than the default. This change in execution flow caused the job to use a more permissive set of credentials—specifically, the access token of the SIEM tenant service account. This service account, which has the cloud-platform scope, possesses extensive permissions across the entire Google Cloud project. By capturing this token on their external server, an attacker could assume the identity of the service account and perform a wide range of unauthorized actions, including accessing, exfiltrating, or modifying data in the SIEM.
Proof of Concept
- Access Google Security Operations → Response → Jobs Scheduler
- Choose the “Google Chronicle Alerts Creator Job”
- Input your external server in the API ROOT parameter
- Optional: Untick “Verify SSL” if necessary
- Run the job by pressing the play button
- The access token should be in an HTTP request that was sent to your external server
Solution
Google has remediated the issue.
Disclosure Timeline
All information within TRA advisories is provided “as is”, without warranty of any kind, including the implied warranties of merchantability and fitness for a particular purpose, and with no guarantee of completeness, accuracy, or timeliness. Individuals and organizations are responsible for assessing the impact of any actual or potential security vulnerability.
Tenable takes product security very seriously. If you believe you have found a vulnerability in one of our products, we ask that you please work with us to quickly resolve it in order to protect customers. Tenable believes in responding quickly to such reports, maintaining communication with researchers, and providing a solution in short order.
For more details on submitting vulnerability information, please see our Vulnerability Reporting Guidelines page.
If you have questions or corrections about this advisory, please email [email protected]
Contact our sales team