Google Cloud Platform (GCP) Full Internal Connection DB Exfiltration in Looker

Tenable Research has identified and responsibly disclosed a sensitive data exfiltration vulnerability in Looker. This flaw allowed a malicious user to exfiltrate data from Looker's internal databases by using an error-based SQL injection.

This vulnerability stems from a dangerous combination of features within Looker's development environment. An attacker with developer access to a Looker instance could create a new LookML project and, by intercepting and modifying the request, attach it to an internal connection like looker__ilooker. This action granted the attacker access to views and models of the internal database, which are typically restricted.

The core of the exploit involved abusing the LookML tests feature. By crafting a malicious test that contained a specially formatted SQL injection payload, the attacker could force the system to execute the query against the internal database. This allowed for an error-based SQL injection, where the results of the query were returned within a database error message. This primitive enabled an attacker to systematically dump the entire internal database, exposing sensitive information.