Tenable, the exposure management company has disclosed that its Tenable Research team has discovered a critical remote code execution (RCE) vulnerability, dubbed CloudImposer, that could have allowed malicious attackers to execute code on potentially millions of Google Cloud Platform (GCP) servers and their customers’ systems. This vulnerability highlights a significant security gap in Google Cloud services, specifically impacting App Engine, Cloud Function, and Cloud Composer.

The discovery stems from an in-depth analysis of documentation from both GCP and the Python Software Foundation, revealing that these services were vulnerable to a supply chain attack known as dependency confusion. While this attack technique has been known for several years, Tenable’s research shows a startling lack of awareness and preventive measures against it, even among major tech providers like Google.

Why It Matters

Supply chain attacks in the cloud can be exponentially more damaging than on-premises environments. A single malicious package in a cloud service can spread across vast networks, impacting millions of users. The CloudImposer vulnerability demonstrates the far-reaching consequences of such attacks, emphasising the critical need for both cloud providers and customers to implement robust security measures.

“The blast radius of CloudImposer is immense. By discovering and disclosing this vulnerability, we’ve closed a major door that attackers could have exploited on a massive scale,” said Liv Matan, senior research engineer, at Tenable. “Sharing this research raises awareness and deepens the understanding of these kinds of vulnerabilities, increasing the likelihood of them being patched or discovered sooner; second, it highlights broader concepts that cloud users should be aware of to defend against similar risks and the expanding attack surface. This research empowers the security community and offensive professionals to identify similar vulnerabilities and misconfigurations.”

Key Takeaway

Cloud security requires a collaborative effort between providers and customers. Tenable urges cloud users to analyse their environments and review their package installation processes—particularly the –extra-index-url argument in Python—to mitigate risks of dependency confusion.

Following Tenable’s disclosure, Google has acknowledged and fixed the issue.

More information, including the team’s technical findings and proof of concept, has been published on the Tenable blog and in the technical advisory.