Synopsis
Tenable Research has discovered a Remote Code Execution (RCE) vulnerability in Google Cloud Platform (GCP) Composer. This flaw allowed attackers to execute arbitrary code on GCP servers, leading to potentially widespread impact.
The vulnerability stemmed from GCP Composer's dependency installation process. This vulnerability would have allowed attackers to upload a malicious package to PyPI, which would then be preinstalled on all Composer instances with high permissions.
Attackers could execute code, exfiltrate service account credentials, and move laterally to other GCP services.
Tenable reported this vulnerability to Google VRP as Remote Code Execution. Google acknowledged this issue as remote server-side code execution in normal Google applications.
GCP confirmed the issue was fixed on April 22, 2024.
Solution
The vulnerability was remediated by fixing the script that includes dependencies to be downloaded and installed, and Google can verify that the package is only installed from a private repository. Google also verified the checksum of that package to verify its integrity as an extra precaution.
In each released version of Airflow in Cloud Composer, Google verified the package checksum to ensure that the vulnerability had not been exploited and no users were impacted.
Additionally, Google took steps to educate customers and help them avoid making similar mistakes by updating documentation regarding Python dependencies in GCP services (see additional references).
Additional References
https://cloud.google.com/composer/docs/how-to/using/installing-python-dependencieshttps://cloud.google.com/composer/docs/composer-2/install-python-dependencies
https://cloud.google.com/functions/docs/writing/specifying-dependencies-python
https://cloud.google.com/appengine/docs/standard/python3/specifying-dependencies
Disclosure Timeline
All information within TRA advisories is provided “as is”, without warranty of any kind, including the implied warranties of merchantability and fitness for a particular purpose, and with no guarantee of completeness, accuracy, or timeliness. Individuals and organizations are responsible for assessing the impact of any actual or potential security vulnerability.
Tenable takes product security very seriously. If you believe you have found a vulnerability in one of our products, we ask that you please work with us to quickly resolve it in order to protect customers. Tenable believes in responding quickly to such reports, maintaining communication with researchers, and providing a solution in short order.
For more details on submitting vulnerability information, please see our Vulnerability Reporting Guidelines page.
If you have questions or corrections about this advisory, please email [email protected]
Contact our sales team