Cloud

Cloud vulnerabilities (no CVE)

Cloud vulnerabilities from the Open Cloud Vulnerability Database (OCVDB), a community catalog of provider-side flaws in Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP). These are tracked as their own entity, keyed on the entry slug, and are deliberately kept separate from the Common Vulnerabilities and Exposures (CVE) table: most cloud vulnerabilities are fixed by the provider platform-side and never receive a CVE identifier, so a CVE cannot be their identity. When an entry does name CVEs, they link into the vulnerabilities table; when it names none, this page says so plainly. This page carries metadata and links only. Each summary is the entry's own text, verbatim.

277 cloud vulnerabilities229 with no CVE48 naming a CVECloudSource: Open Cloud Vulnerability Database (OCVDB)

Not a Common Vulnerabilities and Exposures (CVE) list. These entries are tracked separately from the vulnerabilities table and are never mixed into it.

global-admin-entra-id-actor-tokensCloudcritical
Disclosed 2025-09-04 · Published 2025-09-17
Entra ID actor token validation bug allowing cross-tenant global admin
azure
A critical vulnerability discovered in Microsoft's Entra ID (formerly Azure AD) allowed for cross-tenant access and potential global admin privilege escalation. The flaw was found in the legacy Azure AD Graph API, which improperly validated the originating tenant for undocumented "Actor tokens." An attacker could use a token from their own tenant to authenticate as any user, including Global Admins, in any other tenant. This vulnerability bypassed security policies like Conditional Access. The issue was reported to Microsoft, who deployed a global fix within days.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required.
Related CVEs
CVE-2025-55241
Exploitability windowNot specified
Detection methodsReview AuditLogs as recommended in referenced articles.
References
- https://dirkjanm.io/obtaining-global-admin-in-every-entra-id-tenant-with-actor-tokens/
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55241
Discovered by Dirk-jan Mollema (Outsider Security) site ↗View OCVDB entry ↗
dataform-path-traversalCloudcritical
Disclosed 2025-08-21
Dataform cross-tenant path traversal
gcpDataform
Dataform could have allowed a malicious customer to gain unauthorized cross-tenant access to other customer's code repositories and data. By preparing a maliciously crafted package.json file, an attacker could exploit a path traversal vulnerability in the npm package installation process, thereby gaining read and write access in other customers' repositories. According to Google, there was no evidence of exploitation in the wild.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required.
Related CVEs
CVE-2025-9118
Exploitability window2025/08/07 to 2025/08/21
Detection methodsNot specified
References
- https://cloud.google.com/support/bulletins
- https://www.cve.org/CVERecord?id=CVE-2025-9118
Discovered by an independent researcher (Unknown)View OCVDB entry ↗
aws-ecs-agent-information-disclosure-vulnerabilityCloudmedium
Disclosed 2025-08-14
AWS ECS Agent Information Disclosure Vulnerability
awsECS
A vulnerability in the Amazon ECS agent could allow an introspection server to be accessed off-host. This information disclosure issue, if exploited, could allow another instance in the same security group to access the server's data. The vulnerability does not affect instances where off-host access is set to 'false'. The issue has been patched in version 1.97.1 of the ECS agent.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Users can update the Amazon ECS agent to version 1.97.1 or later. If updating is not an option, customers can restrict incoming access to the introspection server port (51678) by modifying their Amazon EC2 security groups.
Related CVEs
CVE-2025-9039
Exploitability windowNot specified
Detection methodsTo detect if you are running a vulnerable version, check if your ECS agent is version 1.97.0 or earlier. You should also check for any anomalous network activity targeting the introspection server port (51678) in your security group.
References
- https://aws.amazon.com/security/security-bulletins/AWS-2025-018/
Discovered by an independent researcher (Amazon Web Services) site ↗View OCVDB entry ↗
freertos-coresntp-advisoriesCloudlow
Disclosure date not specified · Published 2025-05-10
FreeRTOS and coreSNTP Security Advisories
awsFreeRTOScoreSNTP
Security advisories were issued for FreeRTOS and coreSNTP releases containing unintended scripts that could potentially transmit AWS credentials if executed on Linux/macOS. Affected releases have been removed and users are advised to rotate credentials and delete downloaded copies.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Delete affected release files. Rotate AWS credentials in ~/.aws/credentials. Contact AWS Support if needed.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2025/05/08
Detection methodsCheck SHA256 hashes of downloaded FreeRTOS/coreSNTP release files against those listed in the advisories.
References
Discovered by sweeneyirrigreenView OCVDB entry ↗
azure-aznfs-mount-privilege-escalationCloudhigh
Disclosure date not specified · Published 2025-05-06
Azure AZNFS-mount Utility Root Privilege Escalation
azureAzure Blob StorageAzure HPCAzure AI
A critical vulnerability in AZNFS-mount utility, preinstalled on Azure HPC/AI images, allowed unprivileged users to escalate privileges to root on Linux machines. The flaw existed in versions up to 2.0.10 and involved a SUID binary. Azure classified it as low severity but fixed it in version 2.0.11.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Enable the AZNFS-mount utility's auto-update feature or manually update to version 2.0.11 or later.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2.0.11
Detection methodsCheck for the presence of AZNFS-mount utility versions prior to 2.0.11 on Azure HPC/AI workloads or systems using Azure Blob Storage with NFS.
References
- https://www.varonis.com/blog/aznfs-root-privilege-escalation-on-azure
Discovered by Tal Peleg (Varonis Threat Labs) site ↗View OCVDB entry ↗
aws-default-roles-service-takeoverCloudhigh
Disclosure date not specified · Published 2025-04-29
AWS Default Roles Can Lead to Service Takeover
awsSageMakerGlueEMRCloudFormationCDK
Research uncovered security flaws in default AWS service roles, granting overly broad permissions like full S3 access. This allows privilege escalation, cross-service access, and potential account compromise across services like SageMaker, Glue, and EMR. Attackers could exploit these roles to manipulate critical assets and move laterally within AWS environments. AWS has since updated default policies and documentation to mitigate risks.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Audit existing IAM roles and remove overly permissive policies like AmazonS3FullAccess. Restrict S3 access to only specific required buckets for each service role. Regularly review and enforce least privilege access across all AWS services.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsMonitor for suspicious S3 access patterns or modifications to service-specific buckets. Audit IAM roles for overly broad permissions, especially full S3 access. Use AWS CloudTrail to detect unauthorized actions across services.
References
- https://www.aquasec.com/blog/shadow-roles-aws-defaults-lead-to-service-takeover/
Discovered by Yakir Kadkoda, Ofek Itach (Aqua Security) site ↗View OCVDB entry ↗
gcp-confused-composer-vulnerabilityCloudhigh
Disclosure date not specified · Published 2025-04-22
Google Cloud ConfusedComposer Privilege Escalation Vulnerability
gcpCloud ComposerCloud Build
Tenable discovered a privilege escalation vulnerability in Google Cloud Platform's Cloud Composer service, dubbed ConfusedComposer. It allowed users with composer.environments.update permission to escalate privileges to the default Cloud Build service account by injecting malicious PyPI packages. This could grant broad permissions across the victim's GCP project.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Update existing Cloud Composer instances by April 2025 to use the new behavior that utilizes the Composer environment service account instead of the Cloud Build service account.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil April 2025
Detection methodsMonitor for unexpected PyPI package installations or updates in Cloud Composer environments. Review Cloud Build logs for suspicious activity related to package installations.
References
- https://www.tenable.com/blog/confusedcomposer-a-privilege-escalation-vulnerability-impacting-gcp-composer
Discovered by Liv Matan (Tenable Research) site ↗View OCVDB entry ↗
aws-cdk-cli-credential-plugin-issueCloudhigh
Disclosure date not specified · Published 2025-03-21
AWS CDK CLI Issue with Custom Credential Plugins
awsAWS CDK CLI
AWS identified a security issue in the AWS CDK CLI versions 2.172.0-2.178.1 where temporary credentials from custom credential plugins could be printed to console output. This potentially exposes sensitive information to users with access to the console. The issue affects plugins that include an expiration property when returning temporary credentials.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Upgrade to AWS CDK CLI version 2.178.2 or later. Revoke temporary credentials, limit console access, and rotate long-lived IAM user credentials if affected.
Related CVEs
CVE-2025-2598
Exploitability windowUntil 2025/03/21
Detection methodsScan logs of CDK CLI executions after December 6, 2024 for statements containing accessKeyId, secretAccessKey, and sessionToken. Look for output similar to: { accessKeyId: '<secret>', secretAccessKey: '<secret>', sessionToken: '<secret>', expiration: <date>, '$source': <object> }
References
- https://aws.amazon.com/security/security-bulletins/AWS-2025-005/
Discovered by an independent researcher (AWS) site ↗View OCVDB entry ↗
aws-team-cve-2025-1969Cloudhigh
Disclosure date not specified · Published 2025-03-04
Issue with AWS Temporary Elevated Access Management
awsIAM Identity Center
A vulnerability in AWS Temporary Elevated Access Management (TEAM) allows users to modify valid requests and spoof approvals due to improper input validation. This affects versions prior to 1.2.2 of TEAM for AWS IAM Identity Center. AWS has released a fix in version 1.2.2 and recommends customers upgrade to the latest release.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Upgrade TEAM to version 1.2.2 or later. Refer to the "Update TEAM solution" documentation for specific upgrade instructions.
Related CVEs
CVE-2025-1969
Exploitability windowUntil 2025/03/04
Detection methodsCheck the current version of TEAM in use. If it's below 1.2.2, the system may be vulnerable. Monitor for unexpected or unauthorized elevated access requests in IAM Identity Center.
References
- https://aws.amazon.com/security/security-bulletins/AWS-2025-004/
Discovered by an independent researcher (Redshift Cyber Security)View OCVDB entry ↗
aws-serverless-image-handler-weaknessCloudmedium
Disclosure date not specified · Published 2025-02-19
Abusing AWS Serverless Image Handler Configuration Weakness
awsDynamic Image Transformation for Amazon CloudFrontAWS Serverless Image Handler
AWS solution 'Dynamic Image Transformation for Amazon CloudFront', prior to version 6.2.6, contains a configuration weakness. The Lambda role doesn't constrain bucket access, and the environment variable can be set to a wildcard, allowing access to any bucket. This could potentially lead to unintended access to sensitive images across multiple buckets in the AWS account.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Upgrade to version 6.2.6 or later of the AWS Serverless Image Handler. Ensure that the SOURCE_BUCKET variable is set to specific bucket names and not wildcards. Review and restrict IAM policies for Lambda functions to access only necessary S3 buckets.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 6.2.6
Detection methodsCheck the version of AWS Serverless Image Handler in use. Review Lambda function configurations, particularly the SOURCE_BUCKET environment variable and IAM roles. Audit S3 bucket access logs for unexpected access patterns from Lambda functions associated with this service.
References
- https://www.o3c.no/knowledge/abusing-aws-serverless-image-handler
Discovered by Karim El-Melhaoui (O3 Cyber AS) site ↗View OCVDB entry ↗
aws-ssm-agent-path-traversalCloudhigh
Disclosed 2025-02-12 · Published 2025-04-09
Path Traversal in AWS SSM Agent Plugin ID Validation
awsSystems Manager (SSM)SSM Agent
A path traversal vulnerability in AWS SSM Agent's ValidatePluginId function allows attackers to create directories and execute scripts in unintended locations on the filesystem. This could lead to privilege escalation or other malicious activities, as files may be written to or executed from sensitive areas of the system with root privileges.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2025/03/05
Detection methodsMonitor for unexpected directory creation or file execution in sensitive system areas, especially those involving the SSM Agent. Review SSM document executions for suspicious plugin IDs containing path traversal sequences.
References
- https://cymulate.com/blog/aws-ssm-agent-plugin-id-path-traversal/
Discovered by Elad Beber (Cymulate) site ↗View OCVDB entry ↗
gitlab-duo-prompt-injection-leakCloudhigh
Disclosed 2025-02-12 · Published 2025-05-22
Remote Prompt Injection in GitLab Duo Leaks Source Code
gitlab
A remote prompt injection vulnerability in GitLab Duo allowed attackers to steal source code from private projects, manipulate code suggestions, and exfiltrate confidential information. The attack chain involved hidden prompts, HTML injection, and exploitation of Duo's access to private data. GitLab has since patched both the HTML and prompt injection vectors.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required. GitLab has patched the vulnerability.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2025/02/12
Detection methodsMonitor for unusual or unexpected HTML content in GitLab Duo responses. Watch for suspicious network requests originating from GitLab pages, especially those containing base64-encoded data.
References
- https://www.legitsecurity.com/blog/remote-prompt-injection-in-gitlab-duo
Discovered by Omer Mayraz (Legit Security) site ↗View OCVDB entry ↗
entra-id-upn-update-flawCloudhigh
Disclosed 2025-01-24
Entra ID Allows Users to Update Principal Names
azureEntra ID
A configuration change in Entra ID allowed unprivileged users to update their own User Principal Names (UPNs) through interfaces like the Entra admin center and PowerShell. This could lead to impersonation risks. Microsoft quickly fixed the issue after it was reported. The vulnerability affected synchronized hybrid environments as well.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Administrators should review UPN changes made during the vulnerability period and revert any unauthorized changes. Consider implementing access controls for the Entra admin center and Microsoft Graph PowerShell SDK.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2025/01/24
Detection methodsMonitor audit logs for "Update User" events, particularly changes to the UPN field. Use tools like Search-UnifiedAuditLog cmdlet, Purview Audit solution, or AuditLogsQuery Graph API to review changes.
References
- https://office365itpros.com/2025/01/24/update-user-principal-names/
Discovered by Tony Redmond (Office 365 for IT Pros) site ↗View OCVDB entry ↗
aws-iam-login-username-enumerationCloudmedium
Disclosure date not specified · Published 2025-01-23
AWS Sign-in IAM User Login Flow Username Enumeration
awsIAM
A vulnerability in AWS IAM Sign-in login flow could allow attackers to enumerate IAM usernames by measuring server response times. This issue affected AWS Sign-in IAM User login flow prior to January 16, 2025. AWS has since introduced a delay in response times across all authentication failure scenarios to mitigate the vulnerability.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
CVE-2025-0693
Exploitability windowUntil 2025/01/16
Detection methodsMonitor sign-in activity, including failed and successful sign-in events, using AWS CloudTrail. Refer to the CloudTrail Event Reference documentation for more information.
References
- https://aws.amazon.com/security/security-bulletins/AWS-2025-002/
Discovered by an independent researcher (Rhino Security Labs) site ↗View OCVDB entry ↗
codeql-supply-chain-attack-exposed-secretCloudcritical
Disclosed 2025-01-22 · Published 2025-03-26
CodeQLEAKED - CodeQL Supply Chain Attack via Exposed Secret
githubGitHub CodeQLGitHub Actions
A publicly exposed GitHub token in CodeQL workflow artifacts could allow attackers to execute malicious code in repositories using CodeQL, potentially leading to source code exfiltration, secrets compromise, and supply chain attacks. The vulnerability stemmed from a debug artifact containing environment variables, which could be downloaded and exploited within a 1-2 second window.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Update to CodeQL Action version 3.28.3 or later, or CodeQL CLI version 2.20.3 or later.
Related CVEs
CVE-2025-24362
Exploitability windowUntil 2025/01/22
Detection methodsMonitor for unexpected branch or tag creations in CodeQL-related repositories. Scan workflow artifacts for exposed secrets. Review CodeQL workflow configurations for unsafe tag references.
References
- https://www.praetorian.com/blog/codeqleaked-public-secrets-exposure-leads-to-supply-chain-attack-on-github-codeql/
- https://github.com/advisories/GHSA-vqf5-2xx6-9wfm
Discovered by John Stawinski (Praetorian) site ↗View OCVDB entry ↗
amazon-workspaces-appstream-vulnerabilityCloudhigh
Disclosure date not specified · Published 2025-01-15
Issue with Amazon WorkSpaces and AppStream 2.0 Clients
awsAmazon WorkSpacesAmazon AppStream 2.0Amazon DCV
AWS identified two vulnerabilities in specific versions of native clients for Amazon WorkSpaces, Amazon AppStream 2.0, and Amazon DCV. These issues could allow man-in-the-middle attacks, potentially giving attackers access to remote sessions. Affected versions include WorkSpaces clients 5.20.0 or earlier, AppStream 2.0 Windows client 1.1.1326 or earlier, and various DCV clients. AWS recommends upgrading to patched versions to address these security concerns.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Upgrade to the following versions or later: - WorkSpaces: Windows/macOS 5.21.0+, Linux 2024.2+ - AppStream 2.0: Windows 1.1.1332+ - DCV: Windows 2023.1.9127+, macOS/Linux 2023.1.6703+ For CVE-2025-0501 (PCoIP): Upgrade WorkSpaces clients to 5.22.1+ or Android 5.0.1+
Related CVEs
CVE-2025-0500CVE-2025-0501
Exploitability windowUntil 2025/01/15
Detection methodsCheck client versions of Amazon WorkSpaces, AppStream 2.0, and DCV. If using versions listed as affected, upgrade immediately to mitigate potential man-in-the-middle attacks.
References
- https://aws.amazon.com/security/security-bulletins/AWS-2025-001/
Discovered by an independent researcher (AWS) site ↗View OCVDB entry ↗
azure-ml-notebook-hijackingCloudhigh
Disclosure date not specified · Published 2025-01-08
Hijacking Azure Machine Learning Notebooks
azureAzure Machine LearningAzure Storage
Azure Machine Learning notebooks can be hijacked by attackers with Storage Account access to inject malicious code. A now-fixed vulnerability allowed Reader role escalation to code execution. The article details the attack methods, including modifying notebooks, obtaining managed identity tokens, and exfiltrating data. It also introduces a tool for dumping AML workspace credentials.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Restrict Storage Account access, monitor for suspicious modifications to .ipynb files, and ensure proper access controls on AML workspaces.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsMonitor Azure Activity Logs for suspicious API calls to list AML workspace secrets and Storage Account keys. Set up diagnostics to detect anomalous modifications to .ipynb files in associated Storage Accounts.
References
- https://www.netspi.com/blog/technical-blog/cloud-pentesting/hijacking-azure-machine-learning-notebooks/
Discovered by Karl Fosaaen (NetSPI) site ↗View OCVDB entry ↗
azure-api-connections-secretsCloudhigh
Disclosed 2025-01-06 · Published 2025-03-10
Azure API Connections Expose Backend Secrets
azureLogic AppsKey VaultSQL DatabaseJiraSalesforceStorage BlobsDefender ATP
Azure API Connections were found to allow any reader on a subscription to access backend resources through a proxy endpoint, potentially exposing secrets from Key Vaults, databases, and third-party services. This vulnerability affects various Azure services and external APIs, enabling privilege escalation and unauthorized access to sensitive information.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required. Microsoft has fixed the vulnerability by restricting access to the /extensions/proxy endpoint.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2025/01/17
Detection methodsMonitor for unexpected or unauthorized access attempts to API Connections. Review Azure Activity Logs for suspicious queries to the management.azure.com endpoint, especially those targeting the /extensions/proxy path.
References
- https://binarysecurity.no/posts/2025/03/api-connections
Discovered by Haakon Holm Gulbrandsrud (Binary Security AS) site ↗View OCVDB entry ↗
azure-logic-apps-secrets-control-plane-exfiltrationCloudmedium
Disclosed 2024-12-26 · Published 2025-02-26
Silent Reaper (Azure LogicApp Secrets Control Plane Exfiltration)
azureLogicApps
Azure iPaaS services, such as Logic Apps, separate the Control Plane (management) from the Data Plane (execution), but a flaw in this model enabled undetectable data harvesting. An attacker with Azure Reader access to workflow run history can silently extract sensitive data from executions, including secrets and API responses. This is possible because execution details are exposed via the Control Plane, bypassing Data Plane access controls. The root cause of this issue is the unintended exposure of runtime data through metadata endpoints, which could allow an attacker to passively collect information without triggering alerts or requiring direct execution privileges.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Reduce scope and usage of the Reader role. Assign it via PIM for JIT rather than standing Access. Consider creation of custom roles instead of Reader.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowOngoing
Detection methodsUndetectable, as the required logs are not available to Azure customers (as confirmed by Microsoft).
References
- https://cirriustech.co.uk/blog/azure-silent-reaper/
Discovered by Graham Gold site ↗View OCVDB entry ↗
azure-vault-recon-keyvault-secret-metadata-control-plane-exfiltrationCloudmedium
Disclosed 2024-12-19 · Published 2025-02-26
Vault Recon (Azure KeyVault Secrets Metadata Control Plane Exfiltration)
azureKeyVault
Azure Key Vault enforces a separation between the Control Plane (management) and Data Plane (secrets access). However, a flaw in this isolation allows unauthorized users to enumerate secrets and keys within a vault. By having Reader access or lesser privileges on a Key Vault, an attacker could leverage Azure Resource Explorer to access metadata about stored secrets. This is due to unintended exposure through the Control Plane, which should not provide insight into Data Plane resources. The root cause of this issue is insufficient isolation between the two planes, where metadata retrieval is permitted even when direct access to secrets is restricted. This allows attackers to gain information about sensitive assets without full permissions.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Reduce scope and usage of the Reader role. Assign it via PIM for JIT rather than standing Access. Consider creation of custom roles instead of Reader.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowOngoing
Detection methodsUse a SIEM detection rule using AzureDiagnostics logs.
References
- https://cirriustech.co.uk/blog/azure-vault-recon/
- https://github.com/Az-Skywalker/Az-Skywalker
Discovered by Graham Gold site ↗View OCVDB entry ↗
azure-airflow-vulnerabilitiesCloudlow
Disclosure date not specified · Published 2024-12-16
Dirty DAG - Azure Apache Airflow Integration Vulnerabilities
azureAzure Data Factory
Unit 42 researchers identified vulnerabilities in the Azure Data Factory's integration with Apache Airflow. These vulnerabilities include misconfigured Kubernetes Role-Based Access Control (RBAC), improper secret handling in Azure’s internal Geneva service, and weak authentication mechanisms. Exploiting these flaws, attackers could gain shadow admin control over Azure infrastructure by crafting malicious DAG files or compromising service principals, leading to unauthorized access, data exfiltration, malware deployment, and persistent control of the cluster. Once attackers gain access, they can escalate privileges within the Azure Kubernetes Service (AKS) cluster, compromise containerized environments, and exploit Azure’s Geneva service to manipulate logs and metrics. The research highlighted how weak default configurations allowed attackers to escape containers, obtain root access to host nodes, and enumerate critical Azure resources. This included access to storage accounts, DNS zones, and other sensitive assets.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://unit42.paloaltonetworks.com/azure-data-factory-apache-airflow-vulnerabilities/
Discovered by Ofir Balassiano, David Orlovsky (Palo Alto) site ↗View OCVDB entry ↗
aws-security-tool-riskCloudhigh
Disclosed 2024-12-12 · Published 2025-05-19
AWS Security Tool Introduces Privilege Escalation Risk
awsAccount Assessment for AWS Organizations
AWS's Account Assessment for AWS Organizations tool, designed to audit cross-account access, inadvertently introduced privilege escalation risks due to flawed deployment instructions. Customers were encouraged to deploy the tool in lower-sensitivity accounts, creating risky trust paths from insecure environments into highly sensitive ones. This could allow attackers to pivot from compromised development accounts into production and management accounts.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Uninstall the tool by deleting CloudFormation stacks for Hub, Spoke, and Org-Management components. If needed, redeploy with the hub role in an account with security equivalent to the management account to prevent privilege escalation risks.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2025/01/28
Detection methodsSearch for IAM roles containing "ScanSpokeResource" or "AccountAssessment-Spoke-ExecutionRole" in their names. Use AWS CLI command: aws iam list-roles --query "Roles[?contains(RoleName, 'ScanSpokeResource') || contains(RoleName, 'AccountAssessment-Spoke-ExecutionRole')]"
References
- https://www.token.security/blog/aws-built-a-security-tool-it-introduced-a-security-risk
Discovered by Eliav Livneh (Token Security) site ↗View OCVDB entry ↗
imagerunnerCloudmedium
Disclosed 2024-11-25 · Published 2025-04-01
ImageRunner: Privilege Escalation Vulnerability in GCP Cloud Run
gcpCloud Run
An attacker with `run.services.update` and `iam.serviceAccounts.actAs` permissions but without explicit registry access could deploy new revisions of Cloud Run services that pulled private container images stored in the same GCP project. This was possible because Cloud Run uses a service agent with the necessary registry read permissions to retrieve these images, regardless of the caller’s access level. By updating a service revision and injecting malicious commands into the container's arguments (e.g., using Netcat for reverse shell access), attackers could extract secrets or run unauthorized code. The flaw stemmed from the Cloud Run service agent’s trust model, which did not enforce a separate registry permission check on the deploying identity. Google has since modified this behavior to require that the identity updating the Cloud Run resource also has explicit Artifact Registry Reader or Storage Object Viewer roles.
Remediation posture derived
Not specifiedDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2025/01/25
Detection methodsNot specified
References
- https://www.tenable.com/blog/imagerunner-a-privilege-escalation-vulnerability-impacting-gcp-cloud-run
Discovered by Liv Matan (Tenable) site ↗View OCVDB entry ↗
gcp-vertexai-vulnerabilitiesCloudhigh
Disclosure date not specified · Published 2024-11-12
ModeLeak: LLM Model Exfiltration Vulnerability in Vertex AI
gcpVertexAI
A vulnerability in GCP's Vertex AI service allows privilege escalation and unauthorized access to sensitive LLM models. Attackers can exfiltrate these models by exploiting misconfigurations in access controls and service bindings. By exploiting custom job permissions, researchers were able to escalate their privileges and gain unauthorized access to all data services in the project. In addition, deploying a poisoned model in Vertex AI led to the exfiltration of all other fine-tuned models, posing a proprietary and sensitive data exfiltration attack risk.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://unit42.paloaltonetworks.com/privilege-escalation-llm-model-exfil-vertex-ai/
Discovered by Ofir Balassiano, Ofir Shaty (Palo Alto Networks) site ↗View OCVDB entry ↗
data-all-framework-cvesCloudhigh
Disclosure date not specified · Published 2024-11-08
Issue with data.all Framework Multiple CVEs
awsdata.all
Multiple security vulnerabilities were identified in data.all, an open source development framework for building data marketplaces on AWS. The issues affect versions 1.0.0 through 2.6.0 and include problems with authentication token invalidation, unauthorized operations on DataSets and Environments, incorrect object-level authorizations, potential access to sensitive data via logs, and unauthorized mutating update operations on notification records.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Upgrade to data.all version 2.6.1 or later. Ensure any forked or derivative code is patched to incorporate the new fixes.
Related CVEs
CVE-2024-52311CVE-2024-52312CVE-2024-52313CVE-2024-52314CVE-2024-10953
Exploitability windowUntil 2024/11/08
Detection methodsCheck the installed version of data.all. If using version 2.6.0 or earlier, the system may be vulnerable. Review logs for suspicious activities related to the described vulnerabilities.
References
- https://aws.amazon.com/security/security-bulletins/AWS-2024-013/
Discovered by an independent researcher (Amazon Web Services) site ↗View OCVDB entry ↗
repo-swatting-attack-deletes-github-gitlab-accountsCloudhigh
Disclosed 2024-11-01
Repo swatting attack deletes/blocks GitHub and GitLab accounts
githubgitlab
A technique called "repo swatting" allows attackers to delete GitHub and block GitLab accounts by exploiting file upload features and abuse reporting mechanisms. Attackers upload malicious files to a target's repository, then report the account for hosting malicious content, potentially resulting in account deletion. The vulnerability was partially mitigated by October 2024 via changes in upload URL paths and requirement for each uploader to be authenticated (in GitHub).
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowOngoing, partially mitigated in October 2024
Detection methodsMonitor repositories for unexpected file uploads, especially executables or suspicious file types. Regularly review repository contents and activity logs for any anomalies or unauthorized changes.
References
- https://sourcecodered.com/repo-swatting/
Discovered by Paul McCarty (SourceCodeRed) site ↗View OCVDB entry ↗
azure-api-management-dev-portal-rceCloudhigh
Disclosed 2024-10-22 · Published 2024-12-11
Code Execution in Azure API Management Developer Portal
azureAPI Management Developer Portal
A vulnerability in Azure API Management Developer Portal allows arbitrary code execution and secret exfiltration. The issue stems from a workflow that loads untrusted data from opened issues, potentially allowing attackers to inject malicious commands. This could lead to code execution in the runner, granting access to sensitive tokens and permissions.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2024/11/04
Detection methodsMonitor for suspicious activity in GitHub Actions workflows, especially those handling user-supplied data. Review and audit workflows for potential code injection vulnerabilities.
References
- https://securitylab.github.com/advisories/GHSL-2024-312_Azure_API_Management_Developer_Portal/
Discovered by Alvaro Munoz (GitHub Security Lab) site ↗View OCVDB entry ↗
cloudimposer-gcpCloudhigh
Disclosure date not specified · Published 2024-09-16
CloudImposer
gcpGoogle Cloud ComposerApp EngineCloud Functions
Google Cloud Composer is a managed service for Apache Airflow. Tenable discovered that the Cloud Composer package was vulnerable to dependency confusion, which could have allowed attackers to inject malicious code when the package was compiled from source. This could have led to remote code execution on machines running Cloud Composer, which include various other GCP services as well as internal servers at Google. The dependency confusion stemmed from Google's risky recommendation in their documentation to use the --extra-index-url argument when installing private Python packages. Following disclosure, Google fixed the dependency confusion vulnerability and also updated their documentation.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://www.tenable.com/blog/cloudimposer-executing-code-on-millions-of-google-servers-with-a-single-malicious-package
Discovered by Liv Matan (Tenable) site ↗View OCVDB entry ↗
datazone-confused-deputy-vulnerabilityCloudhigh
Disclosed 2024-08-29 · Published 2024-11-01
Confused Deputy Vulnerability in Amazon DataZone
awsAmazon DataZone
A vulnerability in Amazon DataZone allowed potential attackers to assume roles in AWS accounts by exploiting a confused deputy problem. This could have granted unauthorized access to sensitive data managed by DataZone or other AWS services accessible by the IAM role trusting DataZone. The issue has been resolved, with no customers reportedly impacted.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Ensure AWS accounts associated with a domain are properly vetted, review and audit IAM roles and their trust relationships, and enforce least privilege access principles.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2024/09/25
Detection methodsMonitor for unexpected AssumeRole events from datazone.amazonaws.com in CloudTrail logs, especially for roles not explicitly associated with your DataZone environments.
References
- https://trustoncloud.com/blog/confused-deputy-vulnerability-in-amazon-datazone/
Discovered by Carlos Mora (TrustOnCloud) site ↗View OCVDB entry ↗
entra-id-immutable-users-bugCloudmedium
Disclosed 2024-08-19 · Published 2025-03-25
Entra ID Bug Creates Immutable Users
azureEntra ID
A bug in Entra ID restricted management administrative units allowed creating immutable users that couldn't be modified or disabled, even by Global Administrators. This could enable an attacker to protect a compromised account from containment. The issue was caused by a timing vulnerability when removing users from restricted AUs and required specific steps to remediate affected accounts.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Add affected user to a new restricted management AU, then delete that AU without first removing the user. Wait 5-10 minutes for restricted status to clear.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2025/02/22
Detection methodsMonitor for creation of restricted management AUs and users being added to them. Datadog Cloud SIEM provides detections for these activities.
References
- https://securitylabs.datadoghq.com/articles/creating-immutable-users-entra-id-administrative-units/
Discovered by Katie Knowles (Datadog Security Labs) site ↗View OCVDB entry ↗
wireserving-credentials-azure-kubernetesCloudhigh
Disclosure date not specified · Published 2024-08-19
WireServing Up Credentials in Azure Kubernetes Services
azureAzure Kubernetes Services
A vulnerability in Azure Kubernetes Services allowed attackers to escalate privileges and access cluster credentials. Affected clusters used Azure CNI for network configuration and Azure for network policy. Attackers could exploit this issue to steal data and cause financial and reputational damage. The vulnerability has been fixed by Microsoft after disclosure by Mandiant.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsMonitor for suspicious access to the WireServer (http://168.63.129.16) and HostGAPlugin endpoints. Implement NetworkPolicies to restrict access to these internal Azure services from within Kubernetes pods.
References
- https://cloud.google.com/blog/topics/threat-intelligence/escalating-privileges-azure-kubernetes-services/
Discovered by Nick McClendon, Daniel McNamara, Jacob Paullus (Mandiant) site ↗View OCVDB entry ↗
data-fusion-github-actions-vulnsCloudhigh
Disclosed 2024-08-09 · Published 2024-09-26
Google Cloud Data Fusion GitHub Actions Vulnerabilities
gcpgithubCloud Data Fusion
Multiple "pwn request" vulnerabilities were discovered in Google Cloud Data Fusion, which is based on open-source CDAP code. These vulnerabilities affect GitHub Actions and allow for remote code execution (RCE) and compromise of build artifacts. The issues potentially impact both the Google Cloud platform and GitHub's CI/CD infrastructure.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsMonitor GitHub Actions logs for suspicious activity. Review build artifacts for unexpected changes or injections. Implement security scanning for GitHub Actions workflows, especially those interacting with Google Cloud Data Fusion.
References
- https://bughunters.google.com/reports/vrp/M3Pjk25Sn
Discovered by an independent researcher (Google Bug Hunters)View OCVDB entry ↗
burning-data-azure-sql-firewallCloudhigh
Disclosed 2024-08-05 · Published 2025-04-15
Burning Data with Malicious Firewall Rules in Azure SQL
azureAzure SQL Server
Varonis Threat Labs discovered a vulnerability in Azure SQL Server allowing privileged users to create malicious firewall rules that can delete Azure resources when triggered by admin actions. The exploit involves manipulating rule names via TSQL to inject destructive commands, potentially leading to large-scale data loss in affected Azure accounts.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required. Microsoft has fully patched the vulnerability as of April 09, 2025.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2025/04/09
Detection methodsMonitor for unusual firewall rule creation or modification in Azure SQL Servers, especially rules with suspicious names or IP ranges of 0.0.0.0.
References
- https://www.varonis.com/blog/malicious-firewall-rules-in-azure-sql
Discovered by Coby Abrams (Varonis Threat Labs) site ↗View OCVDB entry ↗
cloudshell-aws-access-vulnerabilityCloudhigh
Disclosed 2024-07-30 · Published 2024-10-15
CloudShell Vulnerability Grants Unintended AWS Access
awsCloudShell
A vulnerability in AWS CloudShell allowed users to gain unintended command-line access to the underlying AWS infrastructure. During a training session, a delegate unexpectedly received the identity context of an EC2 instance role within an ECS cluster, instead of the intended AWS account. This issue potentially bypassed existing controls aimed at preventing lateral movement and access to higher-privileged management roles.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2024/08/30
Detection methodsUsers can detect unexpected access by running 'aws sts get-caller-identity' in CloudShell and comparing the output to their expected IAM user or role.
References
- https://medium.com/@paulschwarzenberger/cloudshell-slip-up-command-line-access-to-underlying-aws-infrastructure-ae77a0858088
Discovered by Paul SchwarzenbergerView OCVDB entry ↗
cloudwatch-dashboard-sharing-exposes-tagsCloudmedium
Disclosed 2024-07-26 · Published 2025-01-16
CloudWatch Dashboard Sharing Exposes EC2 Tags
awsCloudWatchCognitoEC2Lambda
A vulnerability in AWS CloudWatch dashboard sharing allowed viewers to access EC2 instance tags and potentially invoke Lambda functions in the source account. The issue stemmed from a logic bug in the AWS Console combined with a "fail open" condition in Amazon Cognito. AWS has since patched the vulnerability.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Review and limit use of shared dashboards. Restrict IAM permissions for dashboard sharing. Scope additional IAM permissions narrowly when using custom dashboard features.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2024/08/28
Detection methodsMonitor for unexpected EC2:DescribeTags API calls. Review Cognito Identity Pool configurations, especially the AllowClassicFlow setting.
References
- https://labs.withsecure.com/publications/cloudwatch-dashboard
Discovered by Leonidas Tsaousis (WithSecure) site ↗View OCVDB entry ↗
aws-transit-gateway-peering-flawCloudhigh
Disclosed 2024-07-25 · Published 2024-09-12
Security Flaw in AWS Transit Gateway Peering Attachments
awsTransit Gateway
A security flaw in AWS Transit Gateway Peering attachments allowed unauthorized acceptance of peering requests between regions. The exploit bypassed the approval step, granting potential unauthorized access to networks. AWS patched the issue on August 7, 2024, after being notified on July 25, 2024.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Implement SCPs to block the AcceptTransitGatewayPeeringAttachment API call for untrusted accounts or use organization ID-based policies to secure the entire organization.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2024/08/07
Detection methodsMonitor CloudTrail logs for unauthorized AcceptTransitGatewayPeeringAttachment API calls from external accounts. Implement alerts for unexpected state changes in Transit Gateway peering attachments.
References
- https://engineering.doit.com/aws-transit-gateway-peering-exploit-a1715edd4c8a
Discovered by James Sheard (DoiT) site ↗View OCVDB entry ↗
gcp-cloud-functions-privilege-escalation-vulnerabilityCloudhigh
Disclosure date not specified · Published 2024-07-24
GCP Cloud Functions Privilege Escalation Vulnerability
gcpCloud FunctionsCloud Build
A privilege escalation vulnerability dubbed "ConfusedFunction" was discovered in Google Cloud Platform's Cloud Functions service. It allows attackers to escalate privileges from Cloud Function permissions to the default Cloud Build service account during function deployment. The vulnerability affects both first and second-generation Cloud Functions.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
For every cloud function using the legacy Cloud Build service account, replace it with a least-privilege service account.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil mid-June 2024
Detection methodsMonitor for suspicious activity related to Cloud Function deployments and Cloud Build instances. Review IAM permissions and service account usage for Cloud Functions and Cloud Build.
References
- https://www.tenable.com/blog/confusedfunction-a-privilege-escalation-vulnerability-impacting-gcp-cloud-functions
Discovered by Liv Matan (Tenable) site ↗View OCVDB entry ↗
bedrock-api-logging-issueCloudmedium
Disclosed 2024-07-17 · Published 2024-12-12
Bedrock API Logging Issue
awsAmazon BedrockCloudTrail
Sysdig's Threat Research Team discovered an issue with Amazon Bedrock API logging in CloudTrail. Failed API calls were logged as successful without error codes, hindering detection efforts and potentially generating false positives. The issue affected Bedrock Runtime APIs, specifically InvokeModel and Converse. AWS resolved the problem.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2024/08/09
Detection methodsnull
References
- https://sysdig.com/blog/bedrock-slip-sysdig-trt-discovers-cloudtrail-logging-missteps/
Discovered by Alessandro Brucato (Sysdig) site ↗View OCVDB entry ↗
aws-client-vpn-buffer-overflowCloudmedium
Disclosed 2024-07-16
AWS Client VPN buffer overflow
awsAWS Client VPN
The AWS Client VPN service was found to be affected by two vulnerabilities which could potentially allow malicious actors with access to a user’s device to execute arbitrary commands with elevated privileges, including escalating to root access. Both vulnerabilities stem from buffer overflow issues, a common programming error that can be exploited to overwrite memory and gain unauthorized control over a system. The impact of these vulnerabilities is severe, as successful exploitation could lead to complete compromise of an affected device. Attackers could gain access to sensitive data, install malware, or disrupt system operations. Given the widespread use of AWS Client VPN for secure remote access, the potential for widespread exploitation is a significant concern. AWS has acted swiftly to address these vulnerabilities, releasing updated versions of the Client VPN software for all supported platforms. However, the onus is on users to promptly apply these updates to mitigate the risk.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Customers using AWS Client VPN should upgrade to version 3.11.1 or higher for Windows, 3.9.2 or higher for MacOS, and 3.12.1 or higher for Linux.
Related CVEs
CVE-2024-30164CVE-2024-30165
Exploitability windowNot specified
Detection methodsNot specified
References
Discovered by an independent researcher (Robinhood) site ↗View OCVDB entry ↗
aws-cdk-squattingCloudmedium
Disclosed 2024-06-27 · Published 2024-10-24
AWS CDK Bucket Squatting Risk
awsCloud Development Kit (CDK)
The AWS Cloud Development Kit (CDK) is a way of deploying infrastructure-as-code. The vulnerability involves AWS CDK’s use of a predictable S3 bucket name format (cdk-{Qualifier}-assets-{Account-ID}-{Region}), where the default “random” qualifier (hnb659fds) is common and easily guessed. If an AWS customer deletes this bucket and reuses CDK, an attacker who claims the bucket can inject malicious CloudFormation templates, potentially gaining admin access. Attackers supposedly only need the AWS account ID to prepare the bucket in various regions, exploiting the default naming convention. However, it is important to note that the additional conditions greatly lower the likelihood of exploitation. The victim must use the CDK, having deleted the bucket, and then subsequently attempt to deploy with the CDK. Making it so that even if there is a vulnerable account, it could be months, if ever for the attack to work.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
User action is required to upgrade the CDK, and/or to update the CDK’s IAM role’s policy to include an IAM condition to ensure the S3 bucket is owned by the customer.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowOngoing
Detection methodsNot specified
References
- https://www.aquasec.com/blog/aws-cdk-risk-exploiting-a-missing-s3-bucket-allowed-account-takeover/
Discovered by Ofek Itach, Yakir Kadkoda (Aqua) site ↗View OCVDB entry ↗
aws-deployment-framework-issueCloudhigh
Disclosure date not specified · Published 2024-06-11
Issue with AWS Deployment Framework
awsAWS Deployment Framework
CVE-2024-37293 affects the AWS Deployment Framework's bootstrap process, potentially allowing privilege escalation if an actor has permissions to change CodeBuild projects or Lambda functions. The issue is fixed in version 4.0 and above. AWS recommends immediate upgrade and temporary mitigation by adding a permissions boundary to roles created by ADF in the management account.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Upgrade to ADF version 4.0 or above. As temporary mitigation, add a permissions boundary to roles created by ADF in the management account, denying all IAM and STS actions until upgrading or bootstrapping a new account.
Related CVEs
CVE-2024-37293
Exploitability windowUntil 2024/06/11
Detection methodsCheck the version of AWS Deployment Framework in use. Monitor for unauthorized changes to CodeBuild projects or Lambda functions associated with ADF bootstrap process.
References
- https://aws.amazon.com/security/security-bulletins/AWS-2024-005/
Discovered by an independent researcher (Xidian University)View OCVDB entry ↗
ec2-vm-import-export-issueCloudmedium
Disclosure date not specified · Published 2024-06-11
Issue with Amazon EC2 VM Import Export Service
awsAmazon EC2 VM Import Export Service
AWS addressed an issue with the Amazon EC2 VM Import Export Service where importing Windows VMs with custom Sysprep answer files resulted in an unprotected backup copy being created, potentially exposing sensitive data. The issue affected imports made before April 12, 2024, and could impact instances launched from affected AMIs.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Check for .vmimport files in specified directories, restrict access or remove the file, delete affected AMIs, and create new AMIs using the EC2 VMIE Service or EC2 API/Console after applying the fix to the instance.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2024/04/12
Detection methodsSearch for files ending with .vmimport in specified Windows directories associated with Sysprep on imported EC2 instances or instances launched from potentially affected AMIs.
References
- https://aws.amazon.com/security/security-bulletins/AWS-2024-006/
Discovered by an independent researcher (Immersive Labs)View OCVDB entry ↗
vpc-endpoint-log-data-exfilCloudlow
Disclosed 2024-06-04 · Published 2024-10-15
Data exfil via VPC endpoint denials in CloudTrail
awsVPC Endpoints
CloudTrail delivered events to the resource owner and API caller even when the API action was denied by the VPC endpoint policy. This could have enabled a stealthy data exfiltration method in cases where an attacker had previously compromised a VPC, by smuggling data through the user agent field in denied requests.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://tracebit.com/blog/breaching-the-data-perimeter-cloudtrail-as-a-mechanism-for-data-exfiltration
Discovered by Sam Cox (Tracebit) site ↗View OCVDB entry ↗
subdomain-takeover-vulnerability-gitlab-pagesCloudlow
Disclosed 2024-05-28 · Published 2024-10-09
Subdomain Takeover Vulnerability in GitLab Pages
gitlabGitLab Pages
A vulnerability in GitLab Pages allowed attackers to take over dangling custom domains pointing to 'instanceX.gitlab.io'. The issue occured when adding an unverified custom domain to GitLab Pages, which serves content for 7 days before disabling. This could lead to cookie stealing, phishing campaigns, and bypassing of Content-Security Policies and CORS.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Disable the "Force HTTPS" option in GitLab Pages settings for the affected project. Verify and properly configure custom domains before adding them to GitLab Pages.
Related CVEs
CVE-2024-5528
Exploitability windowNot specified
Detection methodsMonitor for unexpected changes in DNS records pointing to GitLab Pages. Regularly audit custom domain configurations in GitLab Pages settings. Check for unauthorized content served on custom domains associated with GitLab Pages.
References
- https://gitlab.com/gitlab-org/gitlab/-/issues/464558
Discovered by Philippe DelteilView OCVDB entry ↗
aws-direct-connect-route-injectionCloudhigh
Disclosed 2024-05-16 · Published 2024-08-15
AWS Direct Connect route injection issue
awsEC2Direct Connect
A BGP-based feature of the AWS Direct Connect service allowed a third party to inject an incorrect route for an external IP, effectively hijacking AWS-sourced traffic. This resulted in connectivity issues between AWS EC2 instances and external systems. The issue was caused by a typo in a Direct Connect customer's configuration, which advertised an incorrect prefix to AWS.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required. AWS has improved their process for validating IP prefix ownership for Direct Connect public virtual interfaces.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsMonitor for unexpected routing or connectivity issues between AWS EC2 instances and external IP addresses. Use tools like mtr or traceroute to identify abnormal network paths.
References
- https://chair6.net/lets-encrypt-renewal-failures-and-aws-traffic-hijacking.html
Discovered by Jamie Finnigan site ↗View OCVDB entry ↗
azure-internal-acr-secretCloudSeverity not specified
Disclosure date not specified · Published 2024-05-16
Internal Azure Container Registry writable via exposed secret
azureAzure IoT EdgeAkriApollo
A Microsoft employee accidentally published credentials via a git commit to a public repository. These credentials granted privileged access to an internal Azure Container Registry (ACR) used by Azure, which reportedly held container images utilized by multiple Azure projects, including Azure IoT Edge, Akri, and Apollo. The privileged access could have allowed an attacker to download private images as well as upload new images and (most importantly) overwrite existing ones. In theory, an attacker could have leveraged the latter to implement a supply chain attack against these Azure projects and their users. However, it is currently unknown precisely which images this ACR contained or how they were used, so the effective impact of this issue remains undetermined.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://www.aquasec.com/blog/github-repos-expose-azure-and-red-hat-secrets/
Discovered by Yakir Kadkoda, Assaf Morag (Aqua) site ↗View OCVDB entry ↗
lethal-injectionCloudcritical
Disclosure date not specified · Published 2024-05-07
Lethal Injection
azureHealth Bot
Multiple vulnerabilities were uncovered in Azure Health Bot service, Microsoft's health chatbot platform. These could have potentially exposed sensitive user data and granted attackers extensive control, allowing unrestricted code execution as root on the bot backend, unrestricted access to authentication secrets & integration auth providers, unrestricted memory read in the bot backend, exposing sensitive secrets, allowing cross-tenant data access and unrestricted deletion of other tenants' public resources. These issues stemmed from various bugs related to URL sanitization, shared compute, and sandboxing. Following disclosure, Microsoft changed the service architecture to run a completely separate ACI instance per customer, thereby mitigating future sandbox escapes, and changed the sandboxing from vm2 to the isolated-vm library (which uses V8 isolates).
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://www.breachproof.net/blog/lethal-injection-how-we-hacked-microsoft-ai-chat-bot
- https://twitter.com/Yanir_/status/1787927285443494137
Discovered by Yanir Tsarimi (Breachproof) site ↗View OCVDB entry ↗
azure-apim-reader-contributor-escalationCloudhigh
Disclosed 2024-04-30 · Published 2024-09-13
Escalating from Reader to Contributor in Azure API Management
azureAPI Management
A vulnerability in Azure API Management allowed users with Reader access to escalate privileges to Contributor level by accessing admin user keys via the ARM API. This permitted full management capabilities through the Direct Management API, including reading secrets and modifying configurations.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Enable "Disable old API versions" setting for Azure API Management instances.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2024/06/04
Detection methodsMonitor for unexpected privilege escalation or configuration changes in Azure API Management resources.
References
- https://binarysecurity.no/posts/2024/09/apim-privilege-escalation
- https://binarysecurity.no/posts/2024/11/apim-privesc
Discovered by Christian Håland (Binary Security AS) site ↗View OCVDB entry ↗
graph-ninjaCloudmedium
Disclosure date not specified · Published 2024-04-29
GraphNinja
azureMicrosoft Graph
A vulnerability in Microsoft Graph allowed attackers to conduct password-spray attacks without detection. The issue involved switching the 'common' authentication endpoint with that of an unrelated tenant, thereby avoiding the appearance of logon attempts in the victim's logs. This technique could allow attackers to validate user credentials through verbose error messages, but actual successful logons using these credentials would still be recorded in the victims' logs (regardless of endpoint).
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowJune 2023 - March 2024
Detection methodsNot specified
References
- https://trustedsec.com/blog/full-disclosure-a-look-at-a-recently-patched-microsoft-graph-logging-bypass-graphninja
Discovered by Nyx Geek (TrustedSec) site ↗View OCVDB entry ↗
gcp-document-ai-data-exfilCloudmedium
Disclosed 2024-04-04 · Published 2024-09-16
Document AI data exfiltration
gcpDocument AICloud Storage
The Document AI service unintentionally allows users to read any Cloud Storage object in the same project, in a way that isn't properly documented. The Document AI service agent is auto-assigned with excessive permissions, allowing it to access all objects from Cloud Storage buckets in the same project. Malicious actors can exploit this to exfiltrate data from Cloud Storage by indirectly leveraging the service agent's permissions. This vulnerability is an instance of transitive access abuse, a class of security flaw where unauthorized access is gained indirectly through a trusted intermediary.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Full remediation is not possible, but mitigating controls can be applied: use the Org Policy Constraint serviceuser.services to prevent the enablement of the Document AI service when it's not needed and restrict the API usage with the Org Policy Constraint serviceuser.restrictServiceUsage.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowOngoing, since the creation of the Document AI Service and its batch processing capabilities.
Detection methodsNot specified
References
- https://www.vectra.ai/blog/transitive-access-abuse-data-exfiltration-via-document-ai
- https://github.com/KatTraxler/document-ai-samples
Discovered by Kat Traxler (Vectra AI) site ↗View OCVDB entry ↗
flowfixationCloudhigh
Disclosure date not specified · Published 2024-03-21
FlowFixation
awsMWAA
A flaw in Amazon Managed Workflows for Apache Airflow (MWAA) could have allowed potential session hijacking and remote code execution. The issue stemmed from a combination of session fixation in the MWAA web management panel and an AWS domain configuration error leading to a cross-site scripting (XSS) attack. Attackers exploiting this could manipulate victims' configurations, trigger workflows, and potentially move laterally to other services within the cloud environment. The exploit of this bug involved deploying malicious code via an Amazon API Gateway that interacts with the victim’s Airflow instance, setting a session cookie that bypasses normal authentication and grants the attacker access.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://www.tenable.com/blog/flowfixation-aws-apache-airflow-service-takeover-vulnerability-and-why-neglecting-guardrails
Discovered by Liv Matan (Tenable) site ↗View OCVDB entry ↗
github-copilot-chat-data-exfiltrationCloudhigh
Disclosed 2024-02-25 · Published 2024-06-14
GitHub Copilot Chat Vulnerable to Data Exfiltration
githubGitHub Copilot Chat
GitHub Copilot Chat VS Code Extension was vulnerable to data exfiltration via prompt injection when analyzing untrusted source code. The vulnerability allowed attackers to access previous conversation turns and append information from the chat history to an image URL, which was then automatically retrieved by Copilot, sending the data to the attacker.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2024/06/12
Detection methodsMonitor for unexpected outbound image requests from the GitHub Copilot Chat extension. Review source code for potential malicious instructions that could trigger prompt injection attacks.
References
- https://embracethered.com/blog/posts/2024/github-copilot-chat-prompt-injection-data-exfiltration/
Discovered by wunderwuzzi (Embrace The Red) site ↗View OCVDB entry ↗
bucket-monopoly-aws-attackCloudhigh
Disclosed 2024-02-16 · Published 2024-08-07
Bucket Monopoly Attack on AWS Services
awsCloudFormationGlueEMRSageMakerCodeStarServiceCatalog
Researchers discovered critical vulnerabilities in 6 AWS services that could allow attackers to breach accounts through malicious S3 buckets. By claiming predictable bucket names, attackers could inject code, steal data, or gain admin access. AWS has since fixed the issues, but the attack vector may still apply to other services and open source projects.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Use aws:ResourceAccount condition in IAM policies to restrict access to trusted buckets. Verify S3 bucket ownership. Use unique identifiers when naming buckets instead of predictable patterns.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2024/06/26
Detection methodsCheck for unexpected S3 buckets matching patterns like "aws-glue-assets-{AccountID}-{Region}". Verify bucket ownership across all regions. Monitor for unauthorized cross-account S3 access.
References
- https://www.aquasec.com/news/critical-vulnerabilities-aws/
- https://www.aquasec.com/blog/bucket-monopoly-breaching-aws-accounts-through-shadow-resources/
Discovered by Yakir Kadkoda, Ofek Itach, Michael Katchinskiy (Aqua Security) site ↗View OCVDB entry ↗
gcp-hmac-keys-insufficient-loggingCloudlow
Disclosed 2024-02-07 · Published 2024-06-17
GCP HMAC Keys do not log creation, deletion or usage
gcpGoogle Cloud Storage XML APICloud Console Private API Service
Cloud Audit Logs do not capture actions mediated through the cloud console private API service (cloudconsole-pa). Consequently, there is no logging of HMAC key creation or deletion linked to user accounts. This absence of logs hampers defenders' ability to alert or monitor the creation of HMAC keys for user accounts, posing a persistence risk, or their deletion, presenting a denial of service risk.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None possible
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowOngoing
Detection methodsNot specified
References
- https://www.vectra.ai/blog/working-as-intended-the-unauditable-unmanageable-keys-in-google-cloud
Discovered by Kat Traxler (Vectra AI) site ↗View OCVDB entry ↗
gcp-hmac-keys-unauditableCloudlow
Disclosed 2024-02-07 · Published 2024-06-17
GCP HMAC Keys are not discoverable or revokable other than for self
gcpGoogle Cloud Storage XML APIGoogle Cloud IAM
GCP administrators face challenges in managing HMAC keys within their organizations, lacking visibility into which user accounts have generated these keys and whether they are actively being used to access storage objects. Additionally, there's a lack of functionality to revoke keys associated with other users, restricting their ability to enforce security policies effectively. Similarly, GCP incident response teams rely on Cloud Logging to monitor Cloud Storage object access, but they lack specific indicators to determine if HMAC keys are being utilized in these access attempts.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
No full remediation is possible at this time. While various containment actions, such as suspending or deleting compromised user accounts, may initially seem effective by rejecting previously created Sigv4 signed headers, reactivating or recreating the same user allows the reuse of credentials unless they have expired. Furthermore, removing Cloud IAM Roles can revoke access to affected storage resources. However, it's important to note that reassigning roles does not invalidate previously created Sigv4 signed headers, allowing them to continue functioning even after the role change.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowOngoing
Detection methodsNot specified
References
- https://www.vectra.ai/blog/working-as-intended-the-unauditable-unmanageable-keys-in-google-cloud
Discovered by Kat Traxler (Vectra AI) site ↗View OCVDB entry ↗
mdc-aws-findings-disclosureCloudhigh
Disclosed 2024-02-07 · Published 2024-07-15
Unauthorized Access to AWS Account Findings in Microsoft Defender for Cloud
azureMicrosoft Defender for Cloud
Microsoft Defender for Cloud at one point provided customers with a flawed configuration template through their public GitHub repository. This template creates resources in the customer's AWS account so that Microsoft Defender for Cloud can scan it. In the rare cases in which this template was deployed, under certain, limited circumstances, Defender for Cloud's security findings for these AWS accounts could be disclosed to unauthorized third parties.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowPrior to 2024/03/07
Detection methodsNot specified
References
- https://www.linkedin.com/pulse/confused-deputy-vulnerability-microsoft-defender-cloud-brandon-evans-9fyge/
Discovered by Brandon Evans, Eric Johnson site ↗View OCVDB entry ↗
azure-hdinsight-dosCloudmedium
Disclosure date not specified · Published 2024-02-06
Azure HDInsight privilege escalation and DoS vulnerabilities
azureHDInsight
Three privilege escalation and denial-of-service vulnerabilities were discovered in Azure HDinsight, related to their usage of Apache Oozie and Ambari. The root cause of at least one of these vulnerabilities is a flaw in Apache Oozie itself, leading to regex denial-of-service (ReDoS). The other two vulnerabilities could allow an authenticated attacker with HDI cluster access to gain cluster administrator privileges and perform any resource service management operation. The vulnerabilities were patched in the October 2023 security update of Azure HDinsight.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Update to HDInsight image 2308221128 or 2310140056.
Related CVEs
CVE-2023-36419CVE-2023-38156
Exploitability windowNot specified
Detection methodsNot specified
References
Discovered by Lidor Ben Shitrit (Orca Security) site ↗View OCVDB entry ↗
synapse-vegas-lpeCloudmedium
Disclosed 2024-01-25 · Published 2024-03-07
Synapse Analytics privilege escalation via intelligent caching
azureSynapse Analytics
Tenable Research discovered a privilege escalation flaw that allows a user to escalate privileges to that of the root user within the context of a Spark VM. This escalation was achieved because of a permissions issue with scripts utilized by the intelligent caching service (AKA "Vegas") present in the environment.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowSeptember 2023 - January 2024
Detection methodsNot specified
References
- https://www.tenable.com/security/research/tra-2024-06
Discovered by Jimi Sebree (Tenable) site ↗View OCVDB entry ↗
azure-firewall-bypassCloudhigh
Disclosed 2024-01-24 · Published 2024-06-03
Abusing Service Tags to Bypass Azure Firewall Rules
azureApplication InsightsDevOpsMachine LearningLogic AppsContainer RegistryLoad TestingAPI ManagementData FactoryAction GroupAI Video IndexerChaos Studio
Tenable Research discovered a vulnerability in Azure allowing attackers to bypass firewall rules based on Service Tags by forging requests from trusted services. It affects over 10 Azure services and enables access to internal/private Azure resources. Microsoft updated documentation to clarify Service Tags' security limitations.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Analyze network rules for Service Tag usage. Add authentication and authorization layers to affected assets. Implement strong network authentication when configuring Azure services' network rules.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsSearch for use of affected Service Tags in network rules. Monitor for unexpected traffic from Azure services to internal resources. Review authentication logs for suspicious access attempts.
References
- https://www.tenable.com/blog/these-services-shall-not-pass-abusing-service-tags-to-bypass-azure-firewall-rules-customer
- https://msrc.microsoft.com/blog/2024/06/improved-guidance-for-azure-network-service-tags/
Discovered by Liv Matan (Tenable) site ↗View OCVDB entry ↗
gcp-gke-sys-allCloudmedium
Disclosed 2024-01-19 · Published 2024-01-24
Google Cloud GKE Unsecure Sys:All Binding
gcpGKE
The system:authenticated group in Kubernetes is a special group that includes all authenticated entities, including human users and service accounts. Anyone who successfully authenticates to the Kubernetes API server, regardless of the authentication method used, will be automatically included in this unique group. Thus, it will share the same roles and permissions of the group. This misunderstanding then creates a significant security loophole when administrators unknowingly bind this group with overly permissive roles.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
In addition to upgrading to GKE version 1.28 or higher, the main way to block this attack vector is to strictly follow the principle of least privilege. In that sense, assigning broad permissions to the system:authenticated group, whether it is deterministic or not, is a clear breach of this principle. Organizations should always aim for granularity.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowOngoing
Detection methodsNot specified
References
- https://orca.security/resources/blog/sys-all-google-kubernetes-engine-risk
- https://cloud.google.com/anthos/clusters/docs/security-bulletins
Discovered by Roi Nisimi (Orca) site ↗View OCVDB entry ↗
bedrock-access-control-flawCloudhigh
Disclosed 2024-01-15 · Published 2024-03-27
Flaw in Bedrock's Foundation Model Access Control
awsAmazon BedrockAWS Marketplace
A flaw in AWS Bedrock's foundation model access control allowed unauthorized subscriptions to certain models, bypassing IAM policies using the aws-marketplace:ProductId condition key. This could lead to compliance issues and financial risks. AWS has since fixed the issue and notified affected customers.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Review IAM policies for Amazon Bedrock, ensure correct permissions are set. Remove model access to affected models if subscription should have been denied. Refer to AWS documentation for instructions on removing model access in Amazon Bedrock.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2024/01/18
Detection methodsMonitor CloudTrail logs for unexpected AcceptAgreementRequest and CreateFoundationModelAgreement events. Review IAM policies and test them to ensure they behave as expected for all foundation models.
References
- https://trustoncloud.com/exposing-the-weakness-how-we-identified-a-flaw-in-bedrocks-foundation-model-access-control/
Discovered by Carlos Mora (TrustOnCloud) site ↗View OCVDB entry ↗
bedrock-models-iam-flawCloudhigh
Disclosed 2024-01-15 · Published 2024-03-24
IAM Policy Flaw Allowed Unauthorized Access to Bedrock Models
awsAWS Bedrock
TrustOnCloud identified a flaw in how AWS Bedrock enforces IAM access controls using the aws-marketplace:ProductId condition key, which is meant to restrict subscriptions to specific foundation models. Their testing revealed that some Bedrock models, including those from Cohere and Stability AI, were not consistently blocked or allowed as intended by IAM policies, posing potential compliance and cost risks. AWS acknowledged and fixed the issue, notifying affected customers and updating testing procedures to prevent future issues.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
null
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil March 17th, 2024
Detection methodsnull
References
- https://trustoncloud.com/blog/exposing-the-weakness-how-we-identified-a-flaw-in-bedrocks-foundation-model-access-control/
Discovered by Carlos Mora (TrustOnCloud) site ↗View OCVDB entry ↗
entra-id-privilege-elevationCloudhigh
Disclosed 2024-01-11 · Published 2024-08-07
Privilege Elevation Vulnerability in Entra ID
azureEntra IDDevice Registration ServiceViva EngageMicrosoft Rights Management Service
Semperis researchers discovered vulnerabilities in Microsoft applications that allowed privilege elevation in Entra ID beyond expected authorization controls. The most severe finding enabled adding users to privileged roles, including Global Administrator, without proper permissions. The issues affected Device Registration Service, Viva Engage, and Microsoft Rights Management Service. Microsoft has since resolved the vulnerabilities.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Inspect affected service principals for lingering credentials using Microsoft Graph. Examine Entra ID audit logs for suspicious activity by Device Registration Service. Treat Application Administrator and Cloud Application Administrator roles as highly privileged.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2024/04/19
Detection methodsCheck for credentials assigned to Device Registration Service and Viva Engage service principals. Search Entra ID audit logs for actions performed by Device Registration Service and credential assignments to its service principal.
References
- https://www.semperis.com/blog/unoauthorized-privilege-elevation-through-microsoft-applications/
Discovered by Eric Woodruff (Semperis) site ↗View OCVDB entry ↗
aws-amplify-iam-role-publicly-assumable-exposureCloudcritical
Disclosed 2024-01-09 · Published 2024-04-15
AWS Amplify IAM role publicly assumable exposure
awsAmplifyCognito
The AWS Amplify service was found to be misconfiguring IAM roles associated with Amplify projects. This misconfiguration caused these roles to be assumable by any other AWS account. Both the Amplify Studio and the Amplify CLI exhibited this behavior. Any Amplify project created using the Amplify CLI built between July 3, 2018 and August 8, 2019 had IAM roles that were assumable by anyone in the world. The same was true if the authentication component was removed from an Amplify project using the Amplify CLI or Amplify Studio built between August 2019 and January 2024. AWS mitigated this vulnerability through backend changes to STS and IAM, and also released a patch for the Amplify CLI to ensure that newly created roles are properly configured in accordance with these changes.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required, but customers should upgrade to Amplify CLI 12.10.1 or higher to ensure that newly created roles are compatible with the backend mitigations.
Related CVEs
CVE-2024-28056
Exploitability windowBetween July 2018 and January 2024
Detection methodsReview CloudTrail logs for suspicious sts:AssumeRoleWithWebIdentity API calls in which the identity pool ID is not owned by an identity pool in the same account.
References
- https://securitylabs.datadoghq.com/articles/amplified-exposure-how-aws-flaws-made-amplify-iam-roles-vulnerable-to-takeover/
- https://aws.amazon.com/security/security-bulletins/AWS-2024-003/
Discovered by Nick Frichette (Datadog) site ↗View OCVDB entry ↗
azure-site-recovery-peCloudhigh
Disclosed 2024-01-09 · Published 2024-02-13
Azure Site Recovery privilege escalation
azureAzure Site Recovery (ASR)
When the ASR service is enabled, it uses an Automation Account with a System-Assigned Managed Identity to manage Site Recovery extensions on VMs. However, the Runbook (a set of scripts for managing extensions) executed by the Automation Account had its job output visible to users, and this output mistakenly included a cleartext Management-scoped Access Token for the System-Assigned Managed Identity, which possesses the Contributor role over the entire Azure subscription. Therefore, lower-privileged user roles who could access the Automation Account's job output could see and use this Access Token. This access allowed these users to impersonate the Managed Identity, thereby elevating their privileges to that of a Contributor for the whole subscription, including the ability to execute commands on VMs as `NT Authority\\SYSTEM`.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://www.netspi.com/blog/technical/cloud-penetration-testing/elevating-privileges-with-azure-site-recovery-services/
Discovered by Joshua Murrell (NetSPI) site ↗View OCVDB entry ↗
microsoft-healthcare-chatbot-vulnerabilitiesCloudhigh
Disclosure date not specified · Published 2024-01-01
Microsoft Healthcare Chatbot Vulnerabilities
azureAzure Health Bot
Multiple vulnerabilities in Microsoft's Azure Health Bot service were discovered, allowing access to sensitive infrastructure and confidential medical data. Issues included sandbox escapes, unrestricted code execution, access to authentication secrets, cross-tenant data exposure, and unauthorized deletion of resources. Microsoft quickly patched the vulnerabilities and restructured the service architecture for improved security.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsMonitor for unusual access patterns or data requests in Azure Health Bot service. Implement logging and auditing for authentication and data access events. Regularly review and update access controls and sandbox configurations.
References
- https://www.breachproof.net/blog/lethal-injection-how-we-hacked-microsoft-ai-chat-bot
Discovered by Yanir Tsarimi (Breachproof) site ↗View OCVDB entry ↗
cloudtrail-data-exfiltrationCloudhigh
Disclosure date not specified · Published 2023-12-20
Data Exfiltration Through CloudTrail
awsCloudTrail
This scenario describes a potential data exfiltration technique using AWS CloudTrail. An attacker with access to CloudTrail logs could potentially extract sensitive information from logged events, including API calls and data modifications. This poses a risk to data confidentiality and could lead to unauthorized access to sensitive information.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Implement strict access controls for CloudTrail logs, use encryption, and regularly audit access to CloudTrail data. Consider using AWS CloudTrail Lake for centralized storage and analysis of logs.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsMonitor CloudTrail access logs for unusual patterns or high-volume data transfers. Implement alerting for suspicious API calls or frequent access to CloudTrail data from unexpected sources.
References
- https://github.com/jfbette/cloudconcerns/blob/main/scenarios/dataleakage/cloudtrail/data-exfiltration-through-cloudtrail.md
View OCVDB entry ↗
critical-gitlab-account-takeover-vulnerabilityCloudcritical
Disclosed 2023-12-20 · Published 2024-04-03
Critical GitLab Account Takeover Vulnerability
gitlab
GitLab addressed a critical vulnerability, CVE-2023-7028, affecting managed SaaS gitlab.com instance as well as self-hosted versions 16.1 to 16.7.1. The flaw could allow account takeovers via unverified email password resets. Third party could intercept the password reset request, add their own email to the request and forward it. GitLab would then send the reset link to the added 3rd-party email. This is in effect an account takeover with only precondition of knowing victim email associated with the GitLab account.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
SaaS instance is patched. On self-hosted - update GitLab to the latest patched version (16.5.10, 16.8.10, or later) to mitigate the vulnerability.
Related CVEs
CVE-2023-7028
Exploitability windowNot specified
Detection methodsMonitor for unauthorized access attempts or unexpected password reset requests. Review logs for suspicious activity related to account authentication and password resets.
References
- https://www.vicarius.io/vsociety/posts/critical-gitlab-account-takeover-vulnerability-cve-2023-7028
- https://gitlab.com/gitlab-org/gitlab/-/issues/436084
Discovered by asterion04 (GitLab) site ↗View OCVDB entry ↗
aws-amazon-q-data-exfilCloudlow
Disclosed 2023-12-04 · Published 2024-01-18
Amazon Q for Business Data Exfiltration
awsAmazon Q
An Indirect Prompt Injection attack can cause the LLM to return markdown tags. This allows an adversary who’s data makes it into the chat context (e.g via an uploaded file) to achieve data exfiltration of the victim’s data by rendering hyperlinks.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://embracethered.com/blog/posts/2024/aws-amazon-q-fixes-markdown-rendering-vulnerability/
Discovered by Johann Rehberger site ↗View OCVDB entry ↗
aws-iam-identity-center-expiryCloudlow
Disclosed 2023-12-01 · Published 2023-12-19
AWS IAM Identity Center Expiry
awsIdentity Center
AWS IAM Identity Center exchanges third-party OIDC tokens for Identity Center-issued tokens. Identity Center relies on the jti claim in the third-party tokens to prevent replay attacks. Identity Center maintained a cache of previously-seen jti values for a fixed period (24 hours) and didn’t enforce that the third-party tokens had expiry claims. This meant that a token with a jti claim and without an exp claim could be replayed after >24 hours had passed.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://awsteele.com/blog/2023/12/19/an-aws-iam-identity-center-vulnerability.html
Discovered by Aidan Steele site ↗View OCVDB entry ↗
cloud-architecture-tool-vulnerabilitiesCloudhigh
Disclosed 2023-11-22 · Published 2024-11-09
Sketchy Cheat Sheet
gcpGoogle Cloud Architecture Diagramming Tool
Multiple vulnerabilities were discovered in Google's Cloud Architecture Diagramming Tool, including XSS, unauthorized access to user data, and misconfigured storage buckets. The issues allowed accessing sensitive customer information and potentially executing arbitrary code. Google ultimately decommissioned the service due to the severity of the flaws.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required. Google has decommissioned the affected service.
Related CVEs
CVE-2023-26140
Exploitability windowUntil 2024/10/01
Detection methodsMonitor for unauthorized access to Google Cloud resources and suspicious OAuth token grants to third-party applications.
References
- https://jdomeracki.github.io/2024/11/09/sketchy_cheat_sheet/
- https://speakerdeck.com/jdomeracki/sketchy_cheat_sheet
Discovered by Jakub Domeracki (Egnyte) site ↗View OCVDB entry ↗
azure-tenant-takeover-microsoft-applicationCloudhigh
Disclosed 2023-11-18 · Published 2024-04-26
Azure tenant takeover via Microsoft application
azureMicrosoft Entra IDMicrosoft Dynamics 365 Supply Chain Visibility
A vulnerability in Microsoft Dynamics 365 Supply Chain Visibility allowed arbitrary takeover of Azure tenants via a malicious reply URL. Clicking a link could grant an attacker directory read access or full tenant control if clicked by a Global Admin, without requiring user consent.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2024/01/29
Detection methodsMonitor for unexpected additions of users to high-privilege roles like Global Administrator. Review sign-in logs for suspicious access from unfamiliar IP addresses or locations.
References
- https://falconforce.nl/arbitrary-1-click-azure-tenant-takeover-via-ms-application/
Discovered by Arnau Ortega (FalconForce) site ↗View OCVDB entry ↗
azure-automation-crypto-miningCloudhigh
Disclosure date not specified · Published 2023-11-08
Azure Automation Service Used for Cryptocurrency Mining
azureAzure Automation Service
SafeBreach Labs researchers developed methods to leverage Microsoft Azure's Automation Service for free, undetectable cryptocurrency mining. They found three ways to execute miners: two using their own environment and Azure's resources for free, and one in a victim's environment undetected. The techniques could potentially be used for any task requiring code execution on Azure.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Monitor logs for suspicious Azure Automation activities like runbook drafts, Python package updates, and PowerShell module updates. Implement strict access controls and regularly audit Automation Account usage.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsMonitor Azure Automation logs for suspicious activities like frequent runbook executions, unusual package/module imports, and unexpected resource usage. Implement anomaly detection for Automation Account behavior.
References
- https://www.safebreach.com/blog/cryptocurrency-miner-microsoft-azure
Discovered by Ariel Gamrian (SafeBreach Labs) site ↗View OCVDB entry ↗
apatchmeCloudmedium
Disclosed 2023-11-02
ApatchMe
awsgcpMWAAComposer
Amazon Managed Workflows for Apache Airflow (MWAA) and the Task instance details page in the Google Composer UI were not patched against CVE-2023-29247 (Stored XSS). This meant that post-authentication, a threat actor could have exploited this to store their JavaScript payload in the victim's managed Apache Airflow instance and run JavaScript on behalf of the victim (who could be an admin or another user with higher permissions than the threat actor, thereby leading to privilege escalation). With JavaScript, threat actors could have run any operation in the session that the victim is able to run — edit tasks, read jobs, run jobs, read plugins and configurations, list connections, add variables and more.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
AWS users should update their instances via the AWS Console. GCP users should take steps to update their Cloud Composer versions to 2.4.2 or later.
Related CVEs
CVE-2023-29247
Exploitability windowNot specified
Detection methodsNot specified
References
- https://www.tenable.com/blog/apatchme-authenticated-stored-xss-vulnerability-in-aws-and-gcp-apache-airflow-services
- https://cloud.google.com/composer/docs/known-issues
Discovered by Liv Matan (Tenable) site ↗View OCVDB entry ↗
azure-openai-control-bypassCloudhigh
Disclosed 2023-10-24 · Published 2023-12-12
Control plane bypass in Azure OpenAI
azureOpenAI
A way to manage Azure OpenAI deployments via the Data Plane was discovered, bypassing key security controls. This allows creation/modification/deletion of deployments without the usual protections of Resource Manager Locks, Azure Policy, and Entra ID authentication.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Avoid using the Azure AI Developer built-in role. Add the affected OpenAI deployment operations to the NotDataActions section of applicable Role Definitions.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2024/04/02
Detection methodsMonitor for unexpected changes to Azure OpenAI deployments, especially those made via the data plane APIs. Review role assignments and custom roles for overly permissive OpenAI permissions.
References
- https://github.com/tyson-trust
- https://trustoncloud.com/how-i-bypassed-the-control-plane-in-azure-openai/
Discovered by Tyson Garrett (TrustOnCloud) site ↗View OCVDB entry ↗
ssrfs-azure-devopsCloudhigh
Disclosed 2023-10-10 · Published 2025-01-17
Finding SSRFs in Azure DevOps
azureAzure DevOps
Three SSRF vulnerabilities were discovered in Azure DevOps, allowing access to internal metadata endpoints and potential CRLF injection. The issues affected the endpointproxy and Service Hooks functionality. DNS rebinding could bypass initial fixes. Microsoft awarded $15,000 in bug bounties for the findings.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required. Microsoft has patched the vulnerabilities.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2024/02/15
Detection methodsMonitor for unusual outbound requests from Azure DevOps servers to internal endpoints or unexpected external domains.
References
- https://binarysecurity.no/posts/2025/01/finding-ssrfs-in-devops
Discovered by Torjus Bryne Retterstøl (Binary Security AS) site ↗View OCVDB entry ↗
aws-2023-010Cloudlow
Disclosure date not specified · Published 2023-10-06
Amazon WorkSpaces Windows client credential logging
awsAmazon WorkSpaces
AWS identified an issue in the Amazon WorkSpaces Windows client which resulted in unintentionally logging connection debugging information to a user's local system. This data could include usernames or passwords if they contain specific characters: \ (backslash) or " (double quotes). If an attacker gained access to an Amazon WorkSpaces user's machine, they could then compromise such credentials from the log.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Update the client to version 5.11.0 or higher. New versions of the client will automatically delete local logs generated by vulnerable versions.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://aws.amazon.com/security/security-bulletins/AWS-2023-010/
View OCVDB entry ↗
azure-ai-playground-data-exfilCloudlow
Disclosed 2023-09-29 · Published 2023-10-19
Azure AI Playground data exfiltration
azureAI Playground
In Azure AI Playground, a Prompt Injection attack could cause an LLM to return markdown tags. This would have allowed an adversary whose data makes it into the chat context (e.g., via an uploaded file) to achieve exfiltration of the victim’s data by rendering hyperlinks. However, the severity of this issue is low, as there were no integrations that could pull remote content. This means Indirect Prompt Injection was not possible, and it would require the victim to copy the malicious prompt from elsewhere. A similar issue affected GCP Vertex AI.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://embracethered.com/blog/posts/2023/data-exfiltration-in-azure-openai-playground-fixed/
Discovered by Johann Rehberger site ↗View OCVDB entry ↗
cognito-rate-limit-bypassCloudhigh
Disclosed 2023-09-20 · Published 2023-12-27
Amazon Cognito Rate Limit Bypass Vulnerability
awsAmazon Cognito
A rate limit bypass vulnerability was discovered in Amazon Cognito, allowing attackers to potentially brute-force login credentials, password reset PINs, and MFA codes by sending requests in parallel. The vulnerability affected the main login flow, password reset function, and MFA process, potentially exposing user accounts to unauthorized access.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required. Amazon has deployed a fix globally.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2023/12/27
Detection methodsMonitor Cognito logs for unusual patterns of failed login attempts, password resets, or MFA verifications occurring in rapid succession from the same source.
References
- https://luemmelsec.github.io/Amazon-Cognito-Ratelimit-Bypass/
Discovered by Daniel Lümmel (LuemmelSec) site ↗View OCVDB entry ↗
gcp-chronicle-cross-customer-bucket-accessCloudhigh
Disclosed 2023-09-19
Chronicle cross-customer bucket access
gcpChronicle
Customers can configure Chronicle to ingest data from customer-owned Cloud Storage buckets using an ingestion feed. Chronicle previously used a shared service account for all customers for granting permission to the bucket. Therefore, one customer's Chronicle instance could be configured to ingest data from another customer's Cloud Storage bucket. However, this required knowledge of the bucket URI.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
null
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowuntil Sept 19, 2023
Detection methodsNot specified
References
- https://cloud.google.com/support/bulletins
- https://x.com/DoggoZW/status/1706290389974495650
Discovered by DoggoZWView OCVDB entry ↗
google-bard-prompt-injectionCloudhigh
Disclosed 2023-09-19 · Published 2023-11-03
Hacking Google Bard via Prompt Injection
gcpGoogle Bard
A vulnerability in Google Bard allowed for prompt injection and data exfiltration through its Extensions feature. By injecting malicious instructions into shared Google Docs, an attacker could force Bard to render images with exfiltrated chat history data in the URL. The exploit bypassed Content Security Policy using Google Apps Script.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2023/10/19
Detection methodsMonitor for unexpected image rendering in Google Bard conversations and unusual data access patterns in Google Docs and Gmail linked to Bard.
References
- https://embracethered.com/blog/posts/2023/google-bard-data-exfiltration/
Discovered by wunderwuzzi (Embrace The Red) site ↗View OCVDB entry ↗
aws-appstream-cloudtrail-bypassCloudlow
Disclosed 2023-09-11
AWS AppStream Cloudtrail Bypass
awsAppStream
Credentials can be extracted from AppStream. When used, they obscure the sourceIP and userName of the initial user. The sourceIP appears as appstream.amazonaws.com.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowongoing
Detection methodsNot specified
References
- https://saransh-rana.gitbook.io/aboutme/bypass-cloudtrail-detection-using-aws-appstream
Discovered by Saransh Rana (CRED) site ↗View OCVDB entry ↗
gcp-vertex-ai-data-exfilCloudlow
Disclosed 2023-08-30 · Published 2023-10-19
Vertex AI Studio data exfiltration
gcpVertex AI Studio
In Vertex AI Studio, a Prompt Injection attack could cause the LLM to return markdown tags. This could have allowed an adversary whose data makes it into the chat context (e.g., via an uploaded file) to achieve exfiltration of the victim’s data by rendering hyperlinks. However, the severity of this issue is low, as there were no integrations that could pull remote content. This means Indirect Prompt Injection was not possible, and it would require the victim to copy the malicious prompt from elsewhere. A similar issue affected Azure AI.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://embracethered.com/blog/posts/2023/google-gcp-generative-ai-studio-data-exfiltration-fixed/
Discovered by Johann Rehberger site ↗View OCVDB entry ↗
google-oauth-vulnerability-indefinite-accessCloudhigh
Disclosed 2023-08-04 · Published 2023-12-15
Google OAuth Vulnerability Allows Indefinite Access
gcpOAuthSlackZoom
A vulnerability in Google OAuth allows employees to retain indefinite access to applications like Slack and Zoom after being removed from their company's Google organization. The issue stems from the ability to create Google accounts using corporate email aliases, which can't be off-boarded by the organization. This bypasses typical account removal processes and poses a significant security risk.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Organizations should disable login with Google and strictly enforce SAML authentication. Service providers should use the HD claim instead of email for authentication and implement invite-only or LDAP group-only account provisioning.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2023/12/15
Detection methodsOrganizations can audit their Google organization settings and check for any non-Gmail Google accounts using corporate email addresses. Service providers can review their OAuth implementation to ensure they're not relying solely on the email claim for authentication.
References
- https://trufflesecurity.com/blog/google-oauth-is-broken-sort-of/
Discovered by Dylan Ayrey (Truffle Security Co.) site ↗View OCVDB entry ↗
github-runner-images-supply-chainCloudcritical
Disclosed 2023-07-22 · Published 2023-12-20
Poisoning GitHub's Runner Images Supply Chain Attack
githubGitHub Actions
A critical vulnerability in GitHub's actions/runner-images repository allowed arbitrary code execution on self-hosted runners, potentially enabling modification of GitHub's runner base images. The flaw stemmed from misconfigured self-hosted runners on a public repository with default workflow approval settings. The researcher gained persistence, accessed secrets, and could have inserted malicious code into GitHub's runner images used by customers.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Change repository settings to "Require approval for all outside collaborators" for any public repository using self-hosted runners. Apply defense-in-depth measures to self-hosted runners.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2023/07/25
Detection methodsMonitor for unexpected changes to workflow files, especially the runs-on field. Review logs for signs of unauthorized access or unusual activity on self-hosted runners. Implement strict approval processes for workflows from fork pull requests.
References
- https://adnanthekhan.com/2023/12/20/one-supply-chain-attack-to-rule-them-all/
Discovered by Adnan KhanView OCVDB entry ↗
pipelines-agent-ppeCloudhigh
Disclosed 2023-07-22 · Published 2023-12-20
Azure Pipelines Agent poisoned pipeline execution
azuregithubAzure PipelinesGitHub Actions
Azure Pipelines and GitHub Actions allow deployment of runners and agents using VM images sourced from a GitHub-managed repository (github.com/actions/runner-images). This repo was misconfigured to use self-hosted runners insecurely, in a way that could have allowed a malicious external contributor (i.e., anyone who had previously had at least one PR approved and merged in the repo) to poison the repository and achieve code execution on runners in the repo. This in turn could have theoretically allowed an attacker to modify the source code of the images, and thereby conduct a supply chain attack against Pipelines and Actions customers.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2023/07/26
Detection methodsNot specified
References
- https://adnanthekhan.com/2023/12/20/one-supply-chain-attack-to-rule-them-all/
Discovered by Adnan Khan site ↗View OCVDB entry ↗
badbuildCloudlow
Disclosure date not specified · Published 2023-07-18
Bad.Build
gcpCloud Build
An information disclosure vulnerability in the Google Cloud Build service could have allowed an attacker to view sensitive logs if they had gained prior access to a GCP environment and had permission to create a new Cloud Build instance (cloudbuild.builds.create) or permission to directly impersonate the Cloud Build default service account (which is highly privileged by design and therefore considered to be a known privilege escalation vector in GCP). An attacker could then potentially use this information in order to better facilitate lateral movement, privilege escalation or a supply chain attack by other means. This issue was due to excessive permissions granted to the default service account created by Cloud Build, particularly access to audit logs containing all project permissions (logging.privateLogEntries.list).
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://cloud.google.com/build/docs/security-bulletins
- https://orca.security/resources/blog/bad-build-google-cloud-build-potential-supply-chain-attack-vulnerability/
Discovered by Roi Nisimi (Orca Security) site ↗View OCVDB entry ↗
azure-function-credential-extractionCloudhigh
Disclosed 2023-07-12 · Published 2023-11-16
Extracting Managed Identity Credentials from Azure Functions
azureAzure FunctionsManaged Identities
A vulnerability in Azure Function Apps allowed extraction of Managed Identity credentials from the encrypted startup context of Linux containers. This gave attackers with container access the ability to persist as the Managed Identity, breaking the intended security model. Microsoft has since patched the issue by encrypting the sensitive payload.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required. Microsoft has addressed the issue on their end.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2023/11/11
Detection methodsMonitor for unexpected authentication attempts using Managed Identity certificates, especially from IP addresses not associated with the Function App.
References
- https://www.netspi.com/blog/technical/cloud-penetration-testing/mistaken-identity-azure-function-apps/
Discovered by Karl Fosaaen (NetSPI) site ↗View OCVDB entry ↗
azure-cli-credential-leakCloudhigh
Disclosed 2023-07-01 · Published 2023-11-14
Azure CLI Leaks Credentials in GitHub Actions Logs
azuregithubAzure CLI
Azure CLI commands were found to leak sensitive information, including credentials, through GitHub Actions logs. The vulnerability affects multiple Azure CLI commands and could expose secrets in public and private repositories. Microsoft has issued updates to Azure CLI, Azure Pipelines, and GitHub Actions to address the issue.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Update Azure CLI to version 2.54 or later. Use Key Vault to store secrets. Avoid echoing sensitive output in CI/CD logs. Use JMESPath queries or redirect output when using Azure CLI commands.
Related CVEs
CVE-2023-36052
Exploitability windowUntil 2023/11/14
Detection methodsReview GitHub Actions and Azure Pipelines logs for exposed secrets or credentials. Scan repositories for Azure CLI commands that may output sensitive data. Monitor for unauthorized access attempts using exposed credentials.
References
- https://msrc.microsoft.com/blog/2023/11/microsoft-guidance-regarding-credentials-leaked-to-github-actions-logs-through-azure-cli/
- https://www.paloaltonetworks.com/blog/prisma-cloud/secrets-leakage-user-error-azure-cli/
Discovered by Aviad Hahami (Palo Alto Networks Prisma Cloud) site ↗View OCVDB entry ↗
cli-tools-leak-credentials-github-actions-logsCloudhigh
Disclosed 2023-07-01 · Published 2023-11-14
CLI Tools Leak Credentials in GitHub Actions Logs
azureawsgcpAzure CLIAWS CLIGoogle Cloud CLI
Palo Alto discovered that Azure CLI commands were found to leak sensitive credentials and environment variables in GitHub Actions logs. This issue affects both public and private repositories, potentially exposing secrets to unauthorized parties. The problem stems from the Azure CLI's design to echo back accessed/created/updated/deleted resource information, which can include sensitive data. Later research by Orca Security revealed that AWS CLI and Google Cloud CLI were affected by the same issue, but AWS and GCP view this as expected behavior.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Update Azure CLI to version 2.54 or later. Use Azure Key Vault for sensitive values. Store command outputs in variables or use JMESPath queries. Redirect output to /dev/null or use the "--output none" option when running Azure CLI commands in pipelines. As a general rule, avoid storing secrets in environment variables, and instead retrieve them from a dedicated secrets store service such as AWS Secrets Manager.
Related CVEs
CVE-2023-36052
Exploitability windowUntil 2023/11/14 in Azure, ongoing in AWS and GCP
Detection methodsReview GitHub Actions logs for exposed credentials. Check CLI command usage in workflows for proper output handling. Use secrets scanning tools to identify potentially leaked secrets in repository history.
References
Discovered by Aviad Hahami (Palo Alto Networks) site ↗View OCVDB entry ↗
aws-non-production-endpoints-attackCloudhigh
Disclosed 2023-06-27 · Published 2024-05-28
Non-Production AWS Endpoints as Attack Surface
awsECRCost ExplorerRoute 53 ResolverIVS
Researchers identified non-production AWS API endpoints that could be abused for defense evasion, including silent permission enumeration, accessing account data without logging, and partially bypassing CloudTrail. AWS has remediated specific issues but thousands of such endpoints may exist.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required. AWS has remediated the specific vulnerabilities disclosed.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability window2023/06/27 - 2024/05/27
Detection methodsMonitor for API calls to non-standard AWS endpoints. Review CloudTrail logs for unusual event sources or missing expected events.
References
- https://securitylabs.datadoghq.com/articles/non-production-endpoints-as-an-attack-surface-in-aws/
Discovered by Nick Frichette (Datadog Security Labs) site ↗View OCVDB entry ↗
google-workspace-domain-wide-delegation-riskCloudhigh
Disclosed 2023-06-27 · Published 2023-11-30
Google Workspace Domain-Wide Delegation Flaw
gcpGoogle Workspace
Unit 42 researchers discovered a security risk in Google Workspace's domain-wide delegation feature that allows a GCP identity with necessary permissions to generate access tokens to impersonate Google Workspace users and access their data. This mismatch between GCP permissions and Google Workspace access could be exploited by malicious insiders or attackers with stolen credentials.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Position service accounts with domain delegation permissions in higher-level folders in the GCP hierarchy to restrict access. Implement least privilege access and use Prisma Cloud for visibility, alerting and remediation of risky permissions.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil patched
Detection methodsMonitor GCP and Google Workspace audit logs for suspicious service account key creation, authorization events, and granting of domain-wide delegation permissions. Use Cortex XDR and Prisma Cloud for anomaly detection and alerting.
References
Discovered by Zohar Zigdon (Unit 42) site ↗View OCVDB entry ↗
aws-appflow-undocumented-apiCloudlow
Disclosed 2023-06-24 · Published 2023-11-06
AWS AppFlow secrets disclosure
awsAppFlow
AppFlow had an undocumented service called sandstoneconfigurationservicelambda. An undocumented field (awsOwnedManagedAppCredentialsArn) could be used during connector registration and connector updates. Specifying a victim's Secret ARN as that field disclosed the clientId and clientSecret, so long as the victim Secret ARN belonged to a connection profile which is of the type OAuth or contains clientId and clientSecret.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://ronin.ae/news/amazon-appflow-vulnerabilities/
Discovered by an independent researcher (Ronin) site ↗View OCVDB entry ↗
aws-appflow-woocommerce-connector-ssrfCloudlow
Disclosed 2023-06-21 · Published 2023-11-06
AWS AppFlow WooCommerce SSRF
awsAppFlow
The AppFlow WooCommerce connector allowed specification of a full URL. The connector included details of response content when the URL offered an unexpected response. This means you could make arbitrary GET requests to any URL from the WooCommerce connector, and view the response content. The response in the error was truncated to 500 characters.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://ronin.ae/news/amazon-appflow-vulnerabilities/
Discovered by an independent researcher (Ronin) site ↗View OCVDB entry ↗
aws-iam-trust-policy-condition-evaluation-bugCloudlow
Disclosed 2023-06-20 · Published 2024-04-09
AWS IAM Trust Policy Condition Evaluation Bug
awsIAMSTS
Tag variable names affected whether trust policy conditions were evaluated correctly. If the request tag referenced a principal tag called MemberRole in the JWT token, and the IAM role referenced a resource tag with the same variable name, the condition was always evaluated as true, regardless of whether the tag's values actually matched. Only role trust policies that used a variable substitution for both the request tag and the resource tag in the policy statement resulted in the policy evaluating incorrectly. The issue impacted statements within IAM boundary policies and SCP policies that contained the same pattern of STS role assumption with tag-based conditions.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://www.stedi.com/blog/stedi-discovered-an-aws-access-vulnerability
Discovered by an independent researcher (Stedi) site ↗View OCVDB entry ↗
gcs-bucket-traversalCloudmedium
Disclosure date not specified · Published 2023-06-13
Bucket Traversal in Google Cloud Storage Transfer Manager
gcpCloud Storage
A bucket traversal vulnerability was discovered in the google.cloud.storage.transfer_manager.upload_chunks_concurrently() function of Google Cloud Storage. This issue could potentially allow unauthorized access to files in different buckets or directories within the same project.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsMonitor access logs for suspicious file access patterns across different buckets or directories within Google Cloud Storage projects.
References
- https://bughunters.google.com/reports/vrp/h1K5SciPh
Discovered by an independent researcher (Google Bug Hunters) site ↗View OCVDB entry ↗
aws-glue-database-password-leakageCloudlow
Disclosed 2023-06-07 · Published 2024-04-11
AWS Glue database password leakage
awsGlue
A principal with the permissions glue:GetConnection and ec2:DescribeSubnets can retrieve the database password of a connection, since the password is loaded into the AWS console website when a connection's edit page is requested. The severity of this issue is low since it requires sufficient prior access.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://sec-consult.com/vulnerability-lab/advisory/database-passwords-in-server-response-in-amazon-aws-glue/
Discovered by Michael Werner (SEC Consult) site ↗View OCVDB entry ↗
gcp-2023-007Cloudmedium
Disclosure date not specified · Published 2023-06-02
Privilege escalation in GCP Cloud SQL
gcpCloud SQL
A vulnerability was discovered in Cloud SQL for SQL Server that allowed customer administrator accounts to create triggers in the tempdb database and use those to gain sysadmin privileges in the instance. The sysadmin privileges would give the attacker access to system databases and partial access to the machine running that SQL Server instance.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://cloud.google.com/support/bulletins
- https://cloud.google.com/sql/docs/security-bulletins
View OCVDB entry ↗
azure-devops-zero-clickCloudhigh
Disclosed 2023-05-23 · Published 2024-01-31
Azure Devops Zero-Click CI/CD Vulnerability
azuregithubAzure DevOps ServicesAzure Pipelines
Legit Security found a zero-click vulnerability in Azure Pipelines that allows an attacker to access secrets and internal information and perform actions in elevated permissions in the context of a pipeline workflow. This could allow attackers to move laterally in the organization and initiate supply chain attacks. When a pipeline is triggered by a "pipeline resource trigger," it shows in the platform as "Automatically Triggered For …" Instead of running in fork default permissions, preventing any access to secrets and sensitive actions, Azure Pipelines "confuses" the trigger for an internal build allowing access sensitive build secrets. Exploitability depends on a public GitHub repository that runs Azure pipelines on pull-request, with default Azure pipeline fork configurations to trigger pipeline run, and Pipeline-Triggers.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required if you are using Azure DevOps cloud services. Otherwise, make sure you're running a patched build.
Related CVEs
CVE-2023-36561
Exploitability windowNot specified
Detection methodsNot specified
References
- https://www.legitsecurity.com/blog/azure-devops-zero-click-ci/cd-vulnerability
Discovered by Nadav Noy (Legit Security) site ↗View OCVDB entry ↗
guardduty-s3-bypassCloudlow
Disclosure date not specified · Published 2023-05-18
GuardDuty bypass via S3 permission modification
awsGuardDuty
Threat actors in possession of IAM active credentials that had the power to update S3 bucket policies could have bypassed GuardDuty’s S3 detections and silently updated permissions for S3 resources, resulting in a bucket configuration that allowed anonymous data access. This gap in GuardDuty’s alert coverage occurred only when S3’s Block Public Access was not enabled on the account or the bucket, and when KMS-based server-side bucket encryption was not in use. In order to trigger on opening public access, GuardDuty needs to invoke two API calls: GetBucketPublicAccessBlock and GetBucketPolicyStatus. Blocking these specific API calls essentially blocked GuardDuty’s ability to trigger the alerts. Following disclosure, AWS added GD alerts on the creation of any policy that both allows data access but seeks to deny access to configuration information.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2023/04/28
Detection methodsNot specified
References
- https://web.archive.org/web/20240805231624/https://www.gem.security/post/guardduty-improves-data-exfiltration-protections-through-collaboration-with-gem
Discovered by an independent researcher (Gem Security) site ↗View OCVDB entry ↗
azure-front-door-desyncCloudmedium
Disclosed 2023-05-08 · Published 2023-06-27
Azure Front Door client-side desync
azureAzure Front Door
A client-side desync vulnerability was discovered in Front Door, one of Azure's CDN solutions, caused by mishandling of the 'Content-Length' header in HTTP requests. Exploiting this vulnerability would most likely require user interaction through social engineering (such as clicking on a malicious link), but could allow an attacker to steal session cookies or forge responses to victim requests.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
null
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://blog.jeti.pw/posts/knocking-on-the-front-door/
- https://portswigger.net/research/browser-powered-desync-attacks
Discovered by Jeti site ↗View OCVDB entry ↗
azure-mgmt-api-rceCloudmedium
Disclosed 2023-04-28 · Published 2023-06-12
Azure App Services takeover via legacy API
azureAzure Resource Manager (ARM)Azure FunctionsAzure App Services
Binary Security found two vulnerabilities in the legacy Azure Resource Manager (ARM) REST API. The first vulnerability allowed an attacker with Reader access to an Azure Function, acting from a Windows host, to get an admin token that could be exchanged for a master key granting access to all operations in Kudu (the Functions deployment service). This would allow them to tamper with the function by deploying malicious code to it. The other vulnerability allowed an attacker with Reader access to an Azure App Service to read all process environment variables, including Key Vault references. For Azure Functions, this would result in complete compromise of the app.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://binarysecurity.no/posts/2023/06/function-apps-rce
Discovered by Haakon Holm Gulbrandsrud, Christian August Holm Hansen (Binary Security) site ↗View OCVDB entry ↗
bastion-container-reg-xssCloudhigh
Disclosed 2023-04-13 · Published 2023-06-14
XSS in Azure Bastion and Container Registry
azureAzure BastionAzure Container Registry
Orca discovered vulnerabilities in Azure Bastion and Azure Container Registry that could have enabled an attacker to achieve Cross-Site Scripting (XSS) by using iframe postMessages. The vulnerabilities allowed embedding of endpoints within remote attacker-controlled servers using the iframe tag, thereby granting unauthorized access to the victim’s session in the affected service if they were tricked into navigating to an attacker-controlled website. The root cause was that certain web pages in the Bastion and Container Registry customer-facing portals allowed embedding of iframes in remote servers, meaning they were not using mitigations such as the X-Frame-Options header or the frame-ancestors directive in a Content Security Policy (CSP), which would have prevented these issues.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://orca.security/resources/blog/examining-two-xss-vulnerabilities-in-azure-services/
- https://msrc.microsoft.com/blog/2023/06/microsoft-mitigates-set-of-cross-site-scripting-xss-vulnerabilities-in-azure-bastion-and-azure-container-registry/
Discovered by Lidor Ben Shitrit (Orca Security) site ↗View OCVDB entry ↗
noauthCloudmedium
Disclosed 2023-04-11 · Published 2023-06-20
nOAuth
azureAzure AD
Descope identified a possible misconfiguration in Azure AD which could lead to misuse of the "Log in with Microsoft" authentication method on a web app. If an application relies on email attribute claims for authentication (which is against best practice) and also merges user accounts without proper validation, an attacker could falsify an email claim to gain full control over the target account. Descope and Microsoft Microsoft identified several popular multi-tenant applications with users that used an email address with an unverified domain owner, which would therefore be vulnerable to this type of takeover. Following disclosure, Microsoft deployed mitigations to omit token claims from unverified domain owners for most applications.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://msrc.microsoft.com/blog/2023/06/potential-risk-of-privilege-escalation-in-azure-ad-applications/
- https://www.descope.com/blog/post/noauth
Discovered by an independent researcher (Descope) site ↗View OCVDB entry ↗
aws-directory-service-passroleCloudmedium
Disclosed 2023-04-07 · Published 2023-06-07
AWS Directory Service not checking PassRole on EnableRoleAccess
awsDirectory Service
AWS Directory Service didn't check the iam:PassRole permissions when using the EnableRoleAccess action. This could have been used for privilege escalation by an authenticated user with sufficient permissions (ds:EnableRoleAccess), if the role had a trust policy that allowed use by Directory Service.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2023-04-24
Detection methodsRoles trusting Directory Service being assumed by unexpected users.
References
- https://cloudar.be/awsblog/spotted-privilege-escalation-in-aws-directory-service/
- https://aws.amazon.com/security/security-bulletins/AWS-2023-003/
Discovered by Ben Bridts (Cloudar) site ↗View OCVDB entry ↗
power-platform-privilege-escalationCloudcritical
Disclosed 2023-04-05 · Published 2023-08-24
Power Platform Privilege Escalation in Azure AD
azurePower PlatformAzure Active Directory
Secureworks researchers discovered an Azure AD application with an abandoned reply URL related to Microsoft Power Platform. An attacker could leverage this URL to redirect authorization codes, exchange them for access tokens, and call Power Platform API via a middle-tier service to obtain elevated privileges. Microsoft quickly addressed the issue by removing the identified abandoned reply URL from the Azure AD application.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required. Microsoft has addressed the issue by removing the identified abandoned reply URL from the Azure AD application.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2023/04/06
Detection methodsMonitor for abandoned reply URLs in Azure AD applications. Organizations should be aware that deleting the service principal or disabling users' sign-in ability for the affected app would nullify its legitimate use.
References
- https://www.secureworks.com/research/power-platform-privilege-escalation
Discovered by an independent researcher (Secureworks Counter Threat Unit) site ↗View OCVDB entry ↗
power-platform-info-leakCloudhigh
Disclosed 2023-03-30 · Published 2023-08-04
Power Platform Custom Code information disclosure
azurePower Platform
A vulnerability in Power Platform could lead to unauthorized access to Custom Code functions used for custom connectors, thereby allowing cross-tenant information disclosure of secrets or other sensitive information if these were embedded in a Custom Code function. The issue occurred as a result of insufficient access control to Azure Function hosts, which are launched as part of the creation and operation of custom connectors in Microsoft’s Power Platform. An attacker who determined the hostname of the Azure Function associated with the custom connector could interact with the function without authentication. Microsoft fixed the issue by requiring Azure Function keys for accessing the Function hosts and their HTTP trigger. An initial fix was deployed (on June 7th, 2023), but customers using affected Custom Code in a "soft deleted state" (part of a data recovery mechanism) remained vulnerable until a later fix was applied (on August 2nd, 2023).
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://msrc.microsoft.com/blog/2023/08/microsoft-mitigates-power-platform-custom-code-information-disclosure-vulnerability/
- https://www.tenable.com/security/research/tra-2023-25
Discovered by Evan Grant (Tenable) site ↗View OCVDB entry ↗
app-runner-observabilityCloudlow
Disclosed 2023-02-28 · Published 2023-04-03
App Runner cross-tenant observability config info leak
awsApp Runner
The API action ListObservabilityConfigurationsForAccount did not properly validate the "AccountId" parameter that was passed to it. As a result, any account ID could be provided and the API would return the information for that account. This would leak minor information about the observability configuration for App Runner in the account.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2023/03/13
Detection methodsNot specified
References
- https://frichetten.com/blog/minor-cross-tenant-vulns-app-runner
Discovered by Nick Frichette site ↗View OCVDB entry ↗
app-runner-vpc-connectorsCloudlow
Disclosed 2023-02-28 · Published 2023-04-03
App Runner cross-tenant VPC connectors info leak
awsApp Runner
The API action ListVpcConnectorsForAccount did not properly validate the "AccountId" parameter that was passed to it. As a result, any account ID could be provided and the API would return the information for that account. This would leak minor information about the VPC configuration for App Runner in the account including the subnet ID, security group ID, and the VPC Connector ARN.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2023/03/13
Detection methodsNot specified
References
- https://frichetten.com/blog/minor-cross-tenant-vulns-app-runner
Discovered by Nick Frichette site ↗View OCVDB entry ↗
cve-2023-21777Cloudmedium
Disclosure date not specified · Published 2023-02-14
Azure App Service on Azure Stack Hub privilege escalation
azureAzure App Service on Azure Stack Hub
A privilege escalation vulnerability was discovered in Azure App Service on Azure Stack Hub (an on-prem private cloud offering). To exploit this vulnerability, an attacker must have access to the targeted worker role and the ability to deploy a malicious application within the worker. The attack itself is carried out locally on the worker role where a malicious application has been deployed. Exploiting this vulnerability could grant an attacker the ability to access and modify content of a targeted application or workload, allowing them to interact with other tenants' applications and content.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Users of Azure App Service on Azure Stack Hub must update their instances to version 2302 by installing the patch available from Microsoft.
Related CVEs
CVE-2023-21777
Exploitability windowNot specified
Detection methodsNot specified
References
- https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-21777
- https://learn.microsoft.com/en-us/azure-stack/operator/app-service-release-notes-2302
Discovered by Ruslan Sayfiev, Denis Faiustov (GMO Cyber Security) site ↗View OCVDB entry ↗
cloudsql-privescCloudhigh
Disclosed 2023-02-13 · Published 2023-05-24
Cloud SQL for SQL Server privilege escalation
gcpCloud SQL
A vulnerability discovered in GCP's Cloud SQL service allowed customer administrator accounts to create triggers in the tempdb database and use those to gain sysadmin privileges in the instance. This could be abused to result in complete control of the database engine and access to the host OS. An attacker could have listed and accessed files in the host OS, including any secrets on the machine, as well as gaining access to service agents. However, it is unclear from the report if this level of access could have allowed lateral movement within the Cloud SQL service or grant cross-tenant access to other customers' data. The reporters did not disclose any lateral movement and Google stated in their security bulletin that it was not possible.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://www.dig.security/post/gcp-cloudsql-vulnerability-leads-to-internal-container-access-and-data-exposure
- https://cloud.google.com/sql/docs/security-bulletins
Discovered by an independent researcher (Dig) site ↗View OCVDB entry ↗
asset-key-thiefCloudmedium
Disclosed 2023-02-07 · Published 2023-04-19
Asset Key Thief
gcpCloud Asset Inventory
Asset Key Thief was a Google Cloud privilege escalation vulnerability that enabled principals with the "Cloud Asset Viewer" role (or other roles with the `cloudasset.assets.searchAllResources` permission) on the Cloud Asset Inventory API, at the Project, Folder, or Organization level to view and exfiltrate any user-managed Service Account private key under a project within the same Google Cloud environment that had been created or rotated up to a maximum of 12 hours ago. Access to Service Account private keys enable the full assumption of that Service Account's identity and privileges, which would have given attackers with existing access to a Google Cloud environment a persistent and reliable method of lateral movement and privilege escalation. Google has since fixed this vulnerability, but affected customers must rotate their keys manually.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Consider rotating user-managed Service Account keys created prior to 14/03/23. Search for anomalous Service Account activity. Audit principals with access to the "cloudasset.assets.searchAllResources" permission. Search for "google.cloud.asset.v1.AssetService.SearchAllResources" ADMIN_READ data access logs.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://engineering.sada.com/asset-key-thief-disclosure-cfae4f1778b6
Discovered by Jackson Reid (SADA) site ↗View OCVDB entry ↗
google-cloud-api-gateway-bypassCloudcritical
Disclosed 2023-02-01 · Published 2023-06-21
Critical Authentication Bypass in Google Cloud API Gateway
gcpAPI GatewayCloud RunApp EngineCloud Functions
A critical authentication bypass vulnerability was discovered in Google Cloud API Gateway, affecting its JWT authentication method. The flaw, stemming from a business logic bug in the ESPv2 service proxy, allowed attackers to bypass authentication controls by manipulating HTTP methods. This vulnerability impacted various authentication methods including Firebase, Auth0, Okta, and Google ID tokens.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Upgrade to ESVP2 proxy release v2.43.0 or higher. This release ensures that JWT authentication occurs even when the caller specifies x-http-method-override.
Related CVEs
CVE-2023-30845
Exploitability windowUntil 2023/03/01
Detection methodsMonitor for unexpected PUT requests with x-http-method-override header set to POST. Review logs for successful access to restricted endpoints without proper authentication.
References
- https://securingbits.com/bypassing-google-cloud-api-gateway
Discovered by Panagiotis VasilikosView OCVDB entry ↗
aws-control-tower-lack-of-cloudtrail-loggingCloudlow
Disclosed 2023-01-30 · Published 2023-03-20
Partial CloudTrail logging in AWS Control Tower
awsControl Tower
AWS Control Tower was not properly logging to CloudTrail when API calls failed due to a lack of permissions. This could have helped an adversary with existing access to a victim AWS environment avoid detection while enumerating privileges, since any unsuccessful API calls would not generate "access denied" log entries.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2023/02/13
Detection methodsNot specified
References
- https://securitylabs.datadoghq.com/articles/bypass-cloudtrail-aws-service-catalog-and-other/
Discovered by Nick Frichette (Datadog) site ↗View OCVDB entry ↗
aws-service-catalog-cloudtrail-bypassCloudmedium
Disclosed 2023-01-30 · Published 2023-03-19
CloudTrail bypass for AWS Service Catalog
awsService Catalog
Due to an exposed development endpoint, it was possible to bypass CloudTrail logging for both read and write API actions for the Service Catalog service. This could have enabled adversaries to alter Service Catalog resources undetected after gaining a foothold in a victim AWS environment.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2023/02/07
Detection methodsNot specified
References
- https://securitylabs.datadoghq.com/articles/bypass-cloudtrail-aws-service-catalog-and-other/
Discovered by Nick Frichette (Datadog) site ↗View OCVDB entry ↗
iam-multiple-mfaCloudlow
Disclosed 2023-01-19 · Published 2023-04-25
MFA enforcement IAM policy bypass
awsAWS IAM
An AWS-recommended IAM policy that enforced MFA on access keys could have been bypassed due to a change implemented by AWS in November 2022 that allowed IAM users to assign multiple MFA devices to their account. Prior to this change, an attacker that had compromised credentials could not create and assign a new MFA device to bypass the MFA requirement as they would need to first deactivate the user’s existing MFA device. Organisations using SSO which enforces MFA, either via an external IdP or AWS SSO, were not affected by this issue.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNovember 2022 until April 2023
Detection methodsNot specified
References
- https://www.mwrcybersec.com/when-mfa-becomes-sfa
- https://aws.amazon.com/security/security-bulletins/AWS-2023-001/
Discovered by Justin Moorcroft (MWR CyberSec) site ↗View OCVDB entry ↗
aws-codebuild-access-token-leakCloudlow
Disclosed 2023-01-18 · Published 2023-02-25
AWS CodeBuild Token Leakage
awsAWS CodeBuild
An attacker with elevated permissions in CodeBuild could leak the configured credentials for Github/Bitbucket. This was possible by configuring the http_proxy and https_proxy variables, which would allow you to capture the credentials via MITM.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://www.halborn.com/blog/post/halborn-discovers-and-discloses-vulnerability-in-aws-code-build
- https://cloud.hacktricks.xyz/pentesting-cloud/aws-pentesting/aws-post-exploitation/aws-codebuild-post-exploitation/aws-codebuild-token-leakage
Discovered by Carlos Polop (Halborn)View OCVDB entry ↗
client-side-ssrf-google-cloud-project-takeoverCloudhigh
Disclosure date not specified · Published 2023-01-12
Client-Side SSRF to Google Cloud Project Takeover
gcpVertex AI Workbench
A vulnerability in Vertex AI Workbench allowed attackers to take over victims' Google Cloud projects through client-side SSRF. The initial bug involved unauthorized access to authentication tokens, which was later fixed. A bypass was later discovered (and also fixed) using open redirects in Feedburner and CSRF token manipulation.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNone.
References
- https://blog.geekycat.in/posts/client-side-ssrf-to-google-cloud-project-takeover/
Discovered by Sivanesh Ashok, Sreeram KL site ↗View OCVDB entry ↗
unauthorized-access-codespace-secrets-githubCloudhigh
Disclosed 2022-12-30 · Published 2023-03-06
Unauthorized access to Codespace secrets in GitHub
githubGitHub CodespacesGitHub Repository Security Advisory
A vulnerability in GitHub's Repository Security Advisory feature allowed unauthorized users to access plaintext Codespace secrets of any organization, including GitHub itself. The issue stemmed from the new beta feature that allows external users to report vulnerabilities to public repositories, inadvertently granting access to sensitive organization-level secrets.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2022/12/31
Detection methodsOrganizations should review their GitHub Codespace secrets and ensure that no unauthorized access has occurred. Additionally, they should monitor for any suspicious activity related to their GitHub repositories and Codespace environments.
References
- https://www.ophionsecurity.com/post/unauthorized-access-to-codespace-secrets-in-github
Discovered by Rojan Rijal (Ophion Security) site ↗View OCVDB entry ↗
api-mgmt-ssrf-path-traversalCloudhigh
Disclosed 2022-12-21 · Published 2023-05-04
API Management SSRF and path traversal vulnerabilities
azureAzure API Management
Azure API Management is an API gateway service meant to help organizations to create, manage, secure, and monitor APIs across all of their environments. Researchers found three high severity vulnerabilities in the service, two of which are SSRF (Server Side Request Forgery) vulnerabilities, and the third is a path traversal bug. The SSRF issues affected the Azure API Management CORS proxy (which handles schema retrieval) and hosting proxy (which routes API requests to the correct server). An attacker successful in exploiting each of these SSRF vulnerabilities could fake requests from these legitimate servers and thereby gain access to internal Azure services. However, the researchers did not determine the effective impact of this access level, and it's therefore possible that Azure had security measures in place which would have blocked further lateral movement. The path-traversal vulnerability allowed for an unrestricted file upload to the Azure developer portal server. The portal's authenticated mode allows users to upload static files and images to be displayed within the portal website, but this vulnerability could have allowed an attacker to upload code instead, and then potentially execute it on the server itself.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://ermetic.com/blog/azure/when-good-apis-go-bad-uncovering-3-azure-api-management-vulnerabilities/
- https://twitter.com/terminatorLM/status/1654110442082516992
Discovered by Liv Matan (Ermetic) site ↗View OCVDB entry ↗
cve-2023-23383Cloudmedium
Disclosed 2022-12-20 · Published 2023-03-14
Super FabriXss
azureAzure Service Fabric Explorer (SFX)
Azure Service Fabric Explorer (SFX) was affected by an XSS vulnerability that could have allowed a malicious script to be reflected off a web application. After a potential victim clicked on a crafted malicious URL, the attacker could remotely toggle the ‘Cluster’ Event Type setting under the Events tab. This could lead to unauthenticated remote code execution on a container hosted on a Service Fabric node.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
CVE-2023-23383
Exploitability windowNot specified
Detection methodsNot specified
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23383
- https://orca.security/resources/blog/super-fabrixss-azure-vulnerability/
Discovered by Lidor Ben Shitrit (Orca Security) site ↗View OCVDB entry ↗
azure-func-escapeCloudmedium
Disclosed 2022-12-15
Azure Serverless Functions escape to host
azureAzure Serverless Functions
In Azure Serverless Functions, a new container is generated by the host for every function, which is then terminated and deleted after several minutes. Palo Alto discovered that an API call was available to bind one path to another within the container (called "init_server_pkg_mount_BindMount") that could be called by a low-privileged user but executed with root privileges. This could enable a malicious tenant to escalate their privileges to root, and then escape their container by abusing the Linux cgroup v1 “notification on release” feature (a well-known escape to host technique). This last step was possible because the container had been granted the SYS_ADMIN capability, did not have an AppArmor profile, and the cgroup v1 virtual filesystem was mounted as read-writable from within the container (all against container hardening best practice). However, the underlying HyperV host was single-tenant, thereby limiting the blast radius of this vulnerability chain. Following disclosure, Azure added additional validation for bind mount APIs, but the other elements of this attack sequence remain exploitable.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowOngoing
Detection methodsNot specified
References
- https://unit42.paloaltonetworks.com/azure-serverless-functions-security/
Discovered by Aviv Sasson, Daniel Prizmant (Palo Alto) site ↗View OCVDB entry ↗
aws-console-rate-limit-bypassCloudmedium
Disclosed 2022-12-07 · Published 2023-02-06
AWS Console rate limit bypass
awsAWS Console
AWS applies a rate limit to authentication requests made to the AWS Console in an effort to prevent brute-force and credential stuffing attacks. However, a weakness was discovered in the AWS Console authentication flow that allowed a partial bypass of this rate limit by pausing for 5 seconds every 30 attempts. This would enable an attacker to continuously attempt more than 280 passwords per minute (4.6 per second) against IAM users, which could have resulted in account compromise of users without MFA enabled.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil January 26th, 2023
Detection methodsDetect potential brute-force behavior using the CloudTrail ConsoleLogin event.
References
- https://securitylabs.datadoghq.com/articles/aws-console-rate-limit-bypass/
Discovered by Christophe Tafani-Dereeper (Datadog) site ↗View OCVDB entry ↗
brokensesameCloudcritical
Disclosed 2022-12-04 · Published 2023-04-19
BrokenSesame
alibabaApsaraDB RDS for PostgreSQLAnalyticDB for PostgreSQL
ApsaraDB and AnalyticDB contained several vulnerabilities in their PostgreSQL offerings which ultimately allowed unauthorized access to other tenants' databases and the ability to perform a supply-chain attack on both services, which in turn would have allowed remote code execution (RCE) as well. Both services implemented multi-tenancy through a shared K8s cluster, but contained several bugs related to tenant isolation which an attacker could chain together to achieve the above impact. In ApsaraDB, these included privilege escalation to root in a container, a shared PID namespace enabling container escape, and write permissions granted to K8s nodes for a private container image registry utilized by both services. In AnalyticDB, the bugs included file disclosure, command line injection in a privileged container, and susceptibility to the core_pattern container escape technique.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://www.wiz.io/blog/brokensesame-accidental-write-permissions-to-private-registry-allowed-potential-r
Discovered by Ronen Shustin, Shir Tamari (Wiz) site ↗View OCVDB entry ↗
gcp-cloudworkstations-auth-bypassCloudhigh
Disclosed 2022-11-19 · Published 2023-01-13
Bypassing authorization in Google Cloud Workstations
gcpCloud WorkstationsCloud Shell
Several vulnerabilities were present in how Google Cloud Shell (ssh.cloud.google.com) handled OAuth credentials. These included an open-redirect vulnerability, where attackers could redirect users to malicious sites to capture their credentials, and a validation bypass that allowed tokens to be submitted to user-defined URIs, circumventing normal security checks. Additionally, Google Cloud Workstations did not correctly tie the state parameter to the session that generated it, which allowed valid state parameters to be reused across different sessions and users. Combined, these issues created a scenario where credentials to Google Cloud Workstations were susceptible to phishing attacks.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://blog.stazot.com/auth-bypass-in-google-cloud-workstations/
Discovered by Sivanesh Ashok, Sreeram KL site ↗View OCVDB entry ↗
public-ecr-undocumented-apiCloudcritical
Disclosed 2022-11-15 · Published 2022-12-13
ECR Public vulnerability in undocumented API
awsECR Public
A vulnerability in Elastic Container Registry (ECR) Public could have allowed a malicious actor to delete, update, or create ECR Public images, layers, or tags in registries and repositories belonging to any other AWS account, by abusing undocumented API calls. A malicious actor could have exploited this to delete any or all images in the Amazon ECR Public Gallery or update the content of any existing image to inject malicious code on any machine that would pull and run it.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://blog.lightspin.io/aws-ecr-public-vulnerability
- https://aws.amazon.com/security/security-bulletins/AWS-2022-010/
Discovered by Gafnit Amiga (Lightspin) site ↗View OCVDB entry ↗
aws-api-gateway-header-smugglingCloudhigh
Disclosed 2022-11-10 · Published 2023-09-19
AWS API Gateway Header Smuggling and Cache Confusion
awsAPI Gateway
Researchers at Omegapoint identified two issues in AWS API Gateway authorizers: 1) A header rewrite feature could be abused to bypass authorization by overwriting headers after the authorizer lambda processed them. 2) Caching of authorization policies could be exploited to reuse cached policies with modified identification sources, bypassing the authorizer.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Implement proper defense-in-depth access controls in applications behind API Gateway, rather than relying solely on the gateway authorizer for authentication and authorization.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2023/05/10
Detection methodsMonitor for unexpected access patterns or data access across tenant boundaries. Review logs for suspicious header combinations or multiple occurrences of authorization-related headers.
References
Discovered by an independent researcher (Omegapoint) site ↗View OCVDB entry ↗
emojideployCloudhigh
Disclosed 2022-10-26 · Published 2023-01-19
EmojiDeploy
azureAzure Function AppsAzure App ServiceAzure Logic Apps
Multiple Azure Web services use a source control management (SCM) panel powered by Kudu and enabled by default. These services were all susceptible to a CSRF vulnerability due to an overly-permissive regular expression (regex) in a filter for malformed origins. This allowed origin bypass when using a domain name structured as 'victim.scm.azurewebsites.net._.attacker.com' (note the use of '._.', which looks like an emoji). Thus, if a target Azure user were tricked into visiting a specially crafted webpage served by a domain with the above name format, an attacker could exploit this CSRF vulnerability to deploy a zip file containing a malicious payload (such as a webshell) into a target web application (via the /api/zipdeploy endpoint). This could have allowed the attacker to gain remote code execution (RCE) as the 'www' user on the target app, and potentially also lateral movement to other Azure services used by the target organization, depending on what privileges were granted to the app's managed identity.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://ermetic.com/blog/azure/emojideploy-smile-your-azure-web-service-just-got-rced/
Discovered by Liv Matan (Ermetic) site ↗View OCVDB entry ↗
cve-2022-39327Cloudmedium
Disclosure date not specified · Published 2022-10-25
Azure CLI code injection vulnerability
azureAzure CLI
Azure CLI contained a code injection vulnerability that could be exploited in a scenario where the host runs a command where parameter values have been provided by an external untrusted source - these could be specially crafted in such a way as to exploit the vulnerability, leading to remote code execution on the host. The vulnerability is only applicable when the Azure CLI command is run on a Windows machine and with any version of PowerShell and when the parameter value contains the `&` or `|` symbols.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Upgrade to Azure CLI 2.40.0 or greater.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
Discovered by an independent researcher (Microsoft) site ↗View OCVDB entry ↗
docker-command-escaping-github-actions-runnerCloudhigh
Disclosure date not specified · Published 2022-10-24
Docker Command Escaping in GitHub Actions Runner
githubGitHub Actions
A vulnerability in the GitHub Actions Runner allowed untrusted inputs in environment variables to escape and modify docker command invocations. This affected jobs using container actions, job containers, or service containers. The issue has been patched in multiple versions of the runner.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Update to one of the patched runner versions: 2.296.2, 2.293.1, 2.289.4, 2.285.2, or 2.283.4. GHES and GHAE customers should patch their instances for automatic runner upgrades.
Related CVEs
CVE-2022-39321
Exploitability windowUntil 2022/10/24
Detection methodsCheck the version of your GitHub Actions Runner. If using a vulnerable version, review jobs for potential exploitation of environment variables in container-related actions.
References
- https://github.com/advisories/GHSA-2c6m-6gqh-6qg3
Discovered by Juho NurminenView OCVDB entry ↗
cve-2022-37968Cloudmedium
Disclosed 2022-10-11
Azure Arc-enabled Kubernetes privilege escalation
azureAzure ArcAzure Stack Edge
Azure Arc allows customers to connect on-premises Kubernetes clusters to Azure. This is facilitated by middleware (the Azure Arc-enabled Kubernetes agent) which includes a "cluster connect" feature in the form of a reverse proxy. A vulnerability in this feature could allow an unauthenticated user to elevate their privileges and potentially gain remote administrative control over any Azure Arc-enabled cluster, as long as they know its randomly generated external DNS endpoint. Azure Stack Edge devices are also affected, because the service supports deployment of Kubernetes workloads via Azure Arc.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
For Azure Arc customers using auto-upgrade (which is enabled by default), no action is required. Otherwise, the Azure Arc-enabled Kubernetes agent must be updated to versions 1.5.8, 1.6.19, 1.7.18 or 1.8.11 (see link to instructions in references). Azure Stack Edge customers must update to the 2209 release (software version 2.2.2088.5593).
Related CVEs
CVE-2022-37968
Exploitability windowNot specified
Detection methodsNot specified
References
Discovered by Mo Khan (Microsoft) site ↗View OCVDB entry ↗
azure-multiple-ssrfCloudlow
Disclosed 2022-10-08 · Published 2023-01-17
Multiple SSRF vulnerablities in Azure services
azureAzure Machine Learning ServiceAzure API Management ServiceAzure FunctionsAzure Digital Twins Explorer
SSRF vulnerabilities were discovered in four Azure services: unauthenticated SSRF in Azure Digital Twins Explorer and Azure Functions, and authenticated SSRF in Azure API Management Service and Azure Machine Learning Service. All four vulnerabilities were full (non-blind) SSRF. The impact of these vulnerabilities was limited: while they would have allowed an adversary to scan local ports and find new services, endpoints, and files; they would not have allowed them to access metadata, connect to internal services, access unauthorized data, or obtain cross-tenant access.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
Discovered by Lidor Ben Shitrit (Orca Security) site ↗View OCVDB entry ↗
cosmissCloudmedium
Disclosed 2022-10-04 · Published 2022-11-01
CosMiss
azureCosmos DB
Cosmos DB notebooks lacked an authentication check, meaning that if an attacker somehow had prior knowledge of a notebook’s temporary ‘forwardingId’ (a 128bit cryptographically random GUID assigned to a short-lived workspace that expires after an hour), they could gain full permissions on the notebook, including read and write access and the ability to modify the file system of the container running the notebook. These permissions would suffice for an attacker to obtain remote code execution (RCE) in the notebook container. However, this would not allow an attacker to execute notebooks, automatically save notebooks in the victim’s (optionally) connected GitHub repository, or access data in the Cosmos DB account. Following disclosure, Cosmos DB notebooks now require an authorization token in the request header before allowing access.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability window2022/08/12 - 2022/10/06
Detection methodsNot specified
References
- https://msrc-blog.microsoft.com/2022/11/01/microsoft-mitigates-vulnerability-in-jupyter-notebooks-for-azure-cosmos-db/
- https://orca.security/resources/blog/cosmiss-vulnerability-azure-cosmos-db/
Discovered by Lidor Ben Shitrit, Roee Sagi (Orca Security) site ↗View OCVDB entry ↗
data_gateway_rceCloudcritical
Disclosed 2022-09-30 · Published 2023-03-30
Azure on-premises data gateway cross-tenant access
azureOn-premises data gateway
Azure on-premises data gateway allows data transfer between an on-prem customer network and several Azure cloud services, and also enables a connected agent installed locally in an on-prem network to perform certain actions remotely. NetSPI discovered a deserialization issue in Microsoft Power Platform connectors that lead to RCE on several Azure backend servers that processed call backs from on-premises data gateways, effectively allowing unauthorized cross-tenant access.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://www.netspi.com/blog/technical/vulnerability-research/azure-service-bus-power-platform/
Discovered by Nick Landers (NetSPI) site ↗View OCVDB entry ↗
bluebleedCloudSeverity not specified
Disclosed 2022-09-24 · Published 2022-10-19
BlueBleed
azure
In September 22', SOCRadar discovered an insecure public Azure blob storage owned by Microsoft (olyympusv2.blob.core.windows[.]net). This blob storage was used for storing emails and other documents from interactions with their customers (such as contracts and purchase orders). In total, the blob storage contained 2.4TB of data with information concerning thousands of Microsoft customers across dozens of countries, dated between 2017 and August 22'. Following disclosure, Microsoft reconfigured it to be private. According to Microsoft, they found no indication customer accounts or systems were compromised, and directly notified affected customers.
Remediation posture derived
Not specifiedDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
Discovered by an independent researcher (SOCRadar) site ↗View OCVDB entry ↗
imposter-commits-vulnerability-github-actionsCloudmedium
Disclosed 2022-09-08 · Published 2023-03-08
Imposter commits vulnerability in GitHub Actions
githubGitHub Actions
A vulnerability in GitHub Actions allows bypassing workflow settings using commits from forked repositories (rather than commits of the main action repo). This "imposter commits" issue can potentially introduce untrusted code into CI/CD pipelines, posing a risk to the security of the software supply chain. The vulnerability stems from GitHub's handling of forked repositories and how commits are shared between forks and parent repositories. A partial solution to this was GitHub prohibiting partial commit references in workflows, however, no full solution exists currently.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Remove action dependencies that Enable automated tools such as Dependabot to keep GitHub Actions up to date with known branches/tags.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowOngoing, partially mitigated
Detection methodsAudit CI configurations, particularly for sensitive workflows like deployments or artifact signing, to identify any vulnerability to fetching arbitrary imposter commits. Either manually (by auditing action commit hashes and verifying those are part of the main action repo), or by using the open-source tool clank (by Chainguard) to check for potential imposter commits in GitHub Action workflows.
References
- https://www.chainguard.dev/unchained/what-the-fork-imposter-commits-in-github-actions-and-ci-cd
Discovered by Billy Lynch (Chainguard) site ↗View OCVDB entry ↗
azure-pipeline-rceCloudhigh
Disclosed 2022-09-05 · Published 2023-03-30
RCE vulnerability in Azure Pipelines
azureAzure PipelinesAzure DevOps ServicesAzure DevOps Server
Legit Security found an RCE vulnerability in Azure Pipelines that could have allowed an attacker to gain complete control of variables and tasks by exploiting logging commands. This would have enabled them to execute malicious code in a context of a pipeline workflow, which would have granted them access to sensitive secrets such as cloud deployment keys, move laterally in the organization, and potentially initiate supply chain attacks. To exploit this vulnerability, an attacker would have needed permissions to create a pull request or push a commit in a repo integrated with Pipelines.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
CVE-2023-21553
Exploitability windowNot specified
Detection methodsNot specified
References
- https://www.legitsecurity.com/blog/remote-code-execution-vulnerability-in-azure-pipelines-can-lead-to-software-supply-chain-attack
Discovered by Nadav Noy (Legit Security) site ↗View OCVDB entry ↗
aws-appsync-confused-deputyCloudhigh
Disclosed 2022-09-01 · Published 2022-11-21
AWS AppSync confused deputy via ServiceRoleArn
awsAppSync
The AWS AppSync service could be coerced to assume arbitrary roles in other customers' accounts which trusted the AppSync service. This was due to insufficient validation of a serviceRoleArn parameter (caused by a case-sensitivity parsing issue). With this vulnerability, if an adversary knew the ARN of the role associated with AppSync in the target account, they could use it invoke arbitrary AWS API calls.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2022/09/06
Detection methodsSuspicious calls from roles assumed by the AppSync service.
References
- https://securitylabs.datadoghq.com/articles/appsync-vulnerability-disclosure/
- https://aws.amazon.com/security/security-bulletins/AWS-2022-009/
Discovered by Nick Frichette (Datadog) site ↗View OCVDB entry ↗
hellskeychainCloudcritical
Disclosed 2022-08-25 · Published 2022-12-01
Hell's Keychain
ibmIBM Cloud Databases
IBM Cloud Databases for PostgreSQL was vulnerable to an attack sequence comprised of PostgreSQL privilege escalation via SQL Injection and chaining of three secrets scattered in the service environment (a K8s service account token, a private container registry password, and CI/CD server credentials), which were abusable due to overly permissive network access to internal build servers. A malicious actor could have exploited this vulnerability to remotely execute code in other customers’ environments in order to read and modify data stored in their PostgreSQL databases.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://www.wiz.io/blog/hells-keychain-supply-chain-attack-in-ibm-cloud-databases-for-postgresql
- https://www.ibm.com/support/pages/node/6842111
Discovered by Ronen Shustin, Shir Tamari (Wiz) site ↗View OCVDB entry ↗
azure-cloudshell-injectionCloudhigh
Disclosed 2022-08-20 · Published 2022-09-20
Azure Cloud Shell access token theft
azureCloud Shell
An issue in Azure Cloud Shell could have allowed an attacker to take over an Azure App Service domain and leverage it to inject and execute commands in other tenants' terminals if they navigated to the domain while logged into their account. Using this method, an attacker could query the Azure IMDS on other tenants' behalf and thereby obtain their access tokens.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://blog.lightspin.io/azure-cloud-shell-command-injection-stealing-users-access-tokens
Discovered by Gafnit Amiga (Lightspin) site ↗View OCVDB entry ↗
sns-signingcerturl-improper-validationCloudmedium
Disclosure date not specified · Published 2022-08-19
SNS SigningCertUrl improper validation
awsAmazon Simple Notification Service (SNS)
Amazon SNS' signature validation in the official SDK relied on a weak regex for default AWS certificate locations, that would incorrectly match an S3 bucket named `sns`. This bucket happened to be publicly readable and writeable, allowing an attacker to forge messages to any user of the official SDK SNS validator.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://spaceraccoon.dev/exploiting-improper-validation-amazon-simple-notification-service/
- https://2022.cloud-village.org/
Discovered by Eugene Lim site ↗View OCVDB entry ↗
remote-code-execution-via-github-importCloudcritical
Disclosed 2022-08-16 · Published 2022-08-17
Remote Code Execution via GitHub Import
githubGitLab Import
A critical vulnerability in GitLab's GitHub import feature allows remote code execution. The issue stems from improper handling of Sawyer::Resource objects, enabling injection of Redis commands. This can be escalated to execute arbitrary bash commands on the SaaS managed service as well as self-hosted GitLab servers, potentially leading to full system compromise.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required for SaaS service; self-hosted GitLab instances need to be updated to version 15.3.1
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsMonitor for unexpected Redis commands or connections, especially those involving system_hook_push or PagesWorker. Check for unusual network connections or file system changes on GitLab servers.
References
- https://gitlab.com/gitlab-org/gitlab/-/issues/371098
- https://hackerone.com/reports/1672388
Discovered by yvvdwfView OCVDB entry ↗
actions-core-delimiter-injectionCloudmedium
Disclosure date not specified · Published 2022-08-12
Actions Core Delimiter Injection Vulnerability
githubGitHub Actions
The @actions/core package had a delimiter injection vulnerability in the exportVariable function. Attackers could use a known delimiter to break out of a specific variable and assign values to other arbitrary variables. This may have allowed modification of path or environment variables without the intention of workflow or action authors.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Upgrade to @actions/core v1.9.1 or ensure user input does not contain the delimiter '_GitHubActionsFileCommandDelimeter_' before calling core.exportVariable.
Related CVEs
CVE-2022-35954
Exploitability windowUntil 2022/08/12
Detection methodsReview workflows and actions that write untrusted values to the GITHUB_ENV file. Check for potential manipulation of path or other environment variables.
References
- https://github.com/advisories/GHSA-7r3h-m5j6-3q42
Discovered by Juho NurminenView OCVDB entry ↗
aws-ec2-autoscaling-privilege-escalation-vulnerabilityCloudhigh
Disclosed 2022-08-11 · Published 2023-02-14
AWS EC2 Autoscaling Privilege Escalation Vulnerability
awsAmazon EC2 Autoscaling
A privilege escalation vulnerability in Amazon EC2 Autoscaling was identified. The CreateLaunchConfiguration action lacked PassRole validation, allowing users to launch EC2 instances with unauthorized roles. AWS fixed the issue for both CreateLaunchConfiguration and CreateAutoScalingGroup actions, implementing proper PassRole validation when using the instance-id option.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required. AWS has deployed fixes worldwide for both affected actions.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2022/09/09
Detection methodsMonitor for unexpected EC2 instance launches or unusual role assignments in Autoscaling groups. Review CloudTrail logs for suspicious CreateLaunchConfiguration or CreateAutoScalingGroup API calls.
References
- https://www.finra.org/about/technology/blog/finra-security-engineer-finds-privilege-escalation-in-amazon
- https://medium.com/@shubham.agarawal95/bypassing-the-passrole-validation-in-amazon-ec2-autoscaling-be2471d27910
Discovered by Shubham Agrawal (FINRA) site ↗View OCVDB entry ↗
cve-2022-35829Cloudmedium
Disclosed 2022-08-11 · Published 2022-10-11
FabriXss
azureAzure Service Fabric Explorer (SFX)
Service Fabric Explorer (SFX) is a tool for inspecting and managing Azure Service Fabric clusters. An attacker with existing access to a "Deployer" type user with CreateComposeDeployment permissions in a given cluster could create a malicious application with a specially-crafted name. This would lead to client-side template injection (CSTI) and storing a malicious XSS payload in a dashboard shared between users of the same cluster. If a victim user with administrative permissions logged into the compromised SFX dashboard and clicked on the aforementioned payload, the attacker could hijack their permissions to perform a cluster node reset, erasing all customized settings including passwords and security configurations. This would allow the attacker to create new passwords and thereby gain full administrator access of the cluster.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Update Service Fabric Runtime to version 8.1.316 or above.
Related CVEs
CVE-2022-35829
Exploitability windowNot specified
Detection methodsVulnerable versions of Service Fabric Explorer (SFXv1) have URLs in the following format: https://<your instance name>. cloudapp.azure.com:19080 /Explorer/old.html#/ (as opposed to index.html).
References
- https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-35829
- https://orca.security/resources/blog/fabrixss-vulnerability-azure-fabric-explorer/
Discovered by Lidor Ben Shitrit, Roee Sagi (Orca Security) site ↗View OCVDB entry ↗
azure-ad-saml-persistence-flawCloudhigh
Disclosed 2022-08-04 · Published 2023-01-18
Azure AD Flaw Allowed SAML Token Persistence
azureAzure Active Directory
A vulnerability in Azure Active Directory allowed users to retain access to SAML applications after their assignment was removed. Attackers could exploit this to establish persistence and elevate privileges on targeted SAML applications. The flaw was triggered by chaining sign-in with additional application and specific parameters in the token request, bypassing user assignment verification.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required. Microsoft has fixed the issue in Azure Active Directory.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2022/10/25
Detection methodsMonitor for unexpected access to SAML applications, especially after user assignments have been removed. Review Azure AD application consents and permissions for suspicious configurations.
References
- https://www.secureworks.com/research/azure-active-directory-flaw-allowed-saml-persistence
Discovered by an independent researcher (Secureworks Counter Threat Unit) site ↗View OCVDB entry ↗
azure-functions-eopCloudhigh
Disclosed 2022-08-02 · Published 2023-03-23
Azure Function Apps privilege escalation
azureAzure Function Apps
Undocumented APIs used by the Azure Function Apps Portal could have allowed an attacker with existing access to a Reader role on a Function App to escalate their privileges and gain write permissions through arbitrary file reads on Function App containers. For Windows containers, this would only grant an attacker the ability to extract ASP.NET encryption keys (the impact of which remains unclear), but for Linux containers it would have allowed an attacker to read environmental variables containing information that ultimately granted access to Function master keys. This in turn would have allowed overwriting Function App code and gaining remote code execution within the container.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://www.netspi.com/blog/technical/cloud-penetration-testing/azure-function-apps/
Discovered by Karl Fosaaen (NetSPI) site ↗View OCVDB entry ↗
gcp-cloud-workstations-persistence-flawCloudhigh
Disclosure date not specified · Published 2022-07-16
Persistence Vulnerability in GCP Cloud Workstations
gcpCloud Workstations
A critical security flaw in Google Cloud Platform's Cloud Workstations allows unauthorized access and privilege escalation. The vulnerability stems from persistent session management, enabling users to access and exploit credentials of higher-privileged users. This can lead to impersonation, creation of new service accounts with elevated permissions, and bypassing of access controls.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Avoid using shared workstations for sensitive operations. Implement strict session management and credential isolation. Regularly rotate access tokens and monitor for unauthorized access attempts.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsMonitor for unexpected creation of service accounts or changes in IAM permissions. Implement logging and auditing of all actions in Cloud Workstations. Use GCP's Cloud Audit Logs to track API calls and identify anomalies.
References
- https://saransh-rana.gitbook.io/aboutme/maintaining-persistence-via-shared-sessions-on-cloud-workstations
Discovered by Saransh Rana (CRED) site ↗View OCVDB entry ↗
gce_ssh_key_injectionCloudhigh
Disclosed 2022-07-14 · Published 2023-01-12
SSH key injection in Google Cloud Compute Engine
gcpGCE
Google Cloud Compute Engine (GCE) was vulnerable to SSH key injection by abusing an SSH-in-browser feature to change username and password. An attacker could send a specially-crafted link to a target user, and if the victim was logged into GCP and clicked the link, the attacker's SSH username and password would be added to the target machine, thereby allowing the attacker to log into it. This was possible because no random token or CSRF protection had been implemented for the abused feature. For this attack to be successful, an attacker would need to know certain details of the target machine in advance (including the project name, instance zone and instance name), and the machine would need to be configured to allow SSH connections (which is the default setting), and accept connections from any IP address.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://blog.stazot.com/ssh-key-injection-google-cloud/
Discovered by Sivanesh Ashok site ↗View OCVDB entry ↗
aws-codebuild-ecr-iam-vulnCloudmedium
Disclosed 2022-07-04 · Published 2023-02-25
Overprivileged CodeBuild default ECR IAM policy
awsAWS CodeBuildAWS ECR
For AWS CodeBuild, when using a custom container image stored in ECR and the project service role for the credentials to pull the image, the default IAM policy attached to the role to allow pulling the container was over-privileged and allowed the CodeBuild container to overwrite its own build image. An attacker with the ability to read the container credentials from the meta-data service or run commands within the container could thereby overwrite the container to gain persistence within the CodeBuild project.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
For any CodeBuild projects created before July 26, 2022, which are using a custom container image, update those project’s IAM policies to match the updated policy. Please refer to the CodeBuild documentation for updating your project’s IAM policies. https://docs.aws.amazon.com/codebuild/latest/userguide/auth-and-access-control-iam-identity-based-access-control.html#ecr-policies
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil July 26, 2022
Detection methodsNot specified
References
- https://www.asxconsulting.co.uk/blog/codebuild/
Discovered by Will Deane (ASX Consulting) site ↗View OCVDB entry ↗
ghosttokenCloudmedium
Disclosed 2022-06-19 · Published 2023-04-21
GhostToken
gcp
Google users can find and install third-party OAuth applications from Google Marketplace that are integrated with Google Workspace. Each OAuth application client in Google is associated with a GCP project. A bug in the way a GCP project enters a "pending deletion" state when deleted, could have allowed threat actors to make a malicious application invisible and unremovable from the user's account. If an attacker had managed to install an application in an account (e.g., through a phishing attack), they could have exploited this vulnerability to hide their activity from the target user. Depending on the permissions of the malicious application, the attacker could have silently gained access to sensitive information such as private Gmail correspondences, personal files and planned events within the the victim's google account, as well as any GCP resources the user had access to.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
It is recommended that Google users go to the "Apps with access to you account" page and verify that they are familiar with all authorized third-party apps, and that each has the minimal needed permissions.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowuntil 2023/04/07
Detection methodsNot specified
References
- https://astrix.security/ghosttoken-exploiting-gcp-application-infrastructure-to-create-invisible-unremovable-trojan-app-on-google-accounts/
Discovered by an independent researcher (Astrix Security) site ↗View OCVDB entry ↗
cve-2022-29149Cloudhigh
Disclosed 2022-06-14
Azure Open Management Infrastructure (OMI) Elevation of Privilege
azureAzure AutomationAzure DiagnosticsAzure HDInsightAzure Stack Hub
Azure forces the install of an agent on Linux VMs, which contained a vulnerability that allowed privilege escalation (note that this vulnerability is different than OMIGOD, which also resided in the OMI agent).
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
In some cases no manual action is required, but for most Azure services, customers must manually patch the OMI agent. See Microsoft's advisory (linked in references) for further details on how to update in each case.
Related CVEs
CVE-2022-29149
Exploitability windowNot specified
Detection methodsOMI version < 1.6.9.1
References
- https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-29149
Discovered by an independent researcher (Microsoft) site ↗View OCVDB entry ↗
cve-2022-30137Cloudmedium
Disclosed 2022-06-14 · Published 2022-06-28
FabricScape (CVE-2022-30137) - Azure Service Fabric privilege escalation
azureService Fabric
A vulnerability in Service Fabric allows Linux containers to escalate their privileges in order to gain root privileges on the node, and then compromise all of the nodes in the cluster. An attacker would need to have read/write access to the cluster, and the vulnerability could be exploited on containers that are configured to have runtime access, but this is granted by default to every container. Though the bug exists in both the Windows and Linux versions, it is only exploitable on Linux.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Users can check their current Service Fabric version by navigating to their Service Fabric cluster in the Azure console and then clicking on "Fabric upgrades". If the Fabric upgrade mode is configured to "Automatic", the cluster will be updated automatically to the latest secure version. If Fabric upgrade mode is configured to "Manual", customers must update it manually to the latest version (9.0.1035.1 or higher).
Related CVEs
CVE-2022-30137
Exploitability windowuntil 2022/05/24
Detection methodsLinux Service Fabric runtime < 9.0.1035.1
References
Discovered by Aviv Sasson (Palo Alto Networks) site ↗View OCVDB entry ↗
attachmeCloudhigh
Disclosed 2022-06-09 · Published 2022-09-20
AttachMe
ociOCI Volumes
Any unattached storage volume, or attached storage volumes allowing multi-attachment, could have been read from or written to as long as an attacker knew their Oracle Cloud Identifier (OCID), allowing sensitive data to be exfiltrated or even more impactful attacks to be initiated via executable file manipulation in the target tenant's environment.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://wiz.io/blog/attachme-oracle-cloud-vulnerability-allows-unauthorized-cross-tenant-volume-access
Discovered by Elad Gabay (Wiz) site ↗View OCVDB entry ↗
synapse-spark-lpeCloudmedium
Disclosed 2022-06-01 · Published 2022-09-01
Synapse Spark LPE
azureSynapse Analytics
Azure Synapse Analytics is an analytics service for processing data using various runtimes, among them Apache Spark. Synapse provided users the capability to mount Azure File Shares to their Apache Spark Pools via a script called filesharemount.sh that would execute with elevated privileges. This script would mount the File Share to the /synfs directory. There was a race condition in the script where, if successfully exploited, a user could execute the chown command to change the ownership of any directory—including the one containing the filesharemount.sh itself. This enabled a user to execute additional code with root privileges. On its own, the impact of this vulnerability was limited to the user’s own Spark pool, and did not permit cross-tenant access. Following disclosure, Microsoft disabled the ability to mount Azure File Shares to Spark pools, and recommended mounting Data Lake Storage Gen2 or Azure Blob Storage instead.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://orca.security/resources/blog/synapse-local-privilege-escalation-vulnerability-spark/
- https://msrc-blog.microsoft.com/2022/09/01/vulnerability-fixed-in-azure-synapse-spark/
Discovered by Tzah Pahima (Orca Security) site ↗View OCVDB entry ↗
cve-2022-2385Cloudhigh
Disclosed 2022-05-25 · Published 2022-07-11
AWS IAM Authenticator for Kubernetes AccessKeyID Validation Bypass
awsEKS
Amazon Elastic Kubernetes Service (EKS) uses IAM to provide authentication to the cluster through the AWS IAM Authenticator for Kubernetes (aws-iam-authenticator). aws-iam-authenticator can be installed on any Kubernetes cluster, and it is installed by default in any EKS cluster both on AWS cloud and on-premises (Amazon EKS Anywhere). A security issue was discovered in aws-iam-authenticator where an allow-listed IAM identity may be able to modify their username and escalate privileges. The bug allowed an attacker to (1) craft a malicious token with any action value, (2) without signing the cluster ID, (3) that would manipulate the AccessKeyID value. Essentially, in clusters using aws-iam-authenticator, if an {{AccessKeyID}} was mapped to an IAM user with cluster admin privileges, any non-privileged user could have escalated their privileges to cluster admin.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
EKS instances have been auto-updated. For self-hosted installations, upgrading aws-iam-authenticator to v0.5.9 fixes this vulnerability. As a workaround, this vulnerability can be mitigated by not using the {{AccessKeyID}} template value to construct usernames.
Related CVEs
CVE-2022-2385
Exploitability windowOct 2017 - June 2022
Detection methodsNone - this issue affected the logged identity, and is not discernible from valid requests.
References
Discovered by Gafnit Amiga (Lightspin) site ↗View OCVDB entry ↗
mwaa-leaky-logsCloudlow
Disclosed 2022-05-11 · Published 2022-05-31
MWAA logs leak tokens and hostnames
awsMWAA
Two API calls used by Amazon Managed Workflows for Apache Airflow (MWAA) to convert AWS IAM credentials into tokens that can be used to login to Airflow (CreateCliToken and CreateWebLoginToken) were logging the tokens to Cloudtrail. The event included the hostname for the airflow server, so everything required to login to Airflow was in the event. However, the issue was largely mitigated by the fact that the tokens are only valid for 60 seconds and CloudTrail delivers logs on average about every 15 minutes, so the chance of receiving a valid token were low.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowby 2022/05/22
Detection methodsNot specified
References
- https://twitter.com/BenReser/status/1531710736719695872
Discovered by Ben Reser (Vibes) site ↗View OCVDB entry ↗
google-cloud-iap-cors-misconfiguration-email-disclosureCloudmedium
Disclosed 2022-05-03 · Published 2023-01-06
IAP CORS Misconfiguration Allows Email Disclosure
gcpIdentity-Aware Proxy (IAP)
A CORS misconfiguration in Google Cloud's Identity-Aware Proxy (IAP) could have allowed attackers to disclose the email address of an authenticated user in websites protected by IAP, by convincing the user to connect to an attacker-controlled domain. This vulnerability enabled attackers to exploit CORS settings to access sensitive email information of both authenticated and unauthenticated users (with the latter requiring additional social engineering).
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil July 2022
Detection methodsNot specified
References
- https://medium.com/@LogicalHunter/identity-aware-proxy-misconfiguration-google-cloud-vulnerability-813d2a07a4ed
Discovered by Borna NematzadehView OCVDB entry ↗
aws-package-backfillCloudlow
Disclosed 2022-05-01
AWS package backfill attack
aws
Two malicious versions were created of packages previously used by AWS. The packages were officially authored and maintained by AWS before they were removed by their legitimate author, and once the packages were removed, their names became available and the two packages were then populated with malicious code. If AWS-deployed software had any dependencies on these packages, this would have led to a dependency confusion attack.
Remediation posture derived
Not specifiedDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://www.mend.io/resources/blog/aws-targeted-by-a-package-backfill-attack/
Discovered by an independent researcher (Mend Diffend) site ↗View OCVDB entry ↗
cve-2022-33675Cloudlow
Disclosed 2022-04-08 · Published 2022-07-12
Microsoft Azure Site Recovery DLL hijacking
azureAzure Site Recovery
The Microsoft Azure Site Recovery suite contained a DLL hijacking flaw that allowed for privilege escalation from any low privileged user to SYSTEM on hosts where this service was installed. Incorrect permissions on the cxprocessserver service's executable directory allowed new files to be created in it by any user. Since the service ran automatically and with SYSTEM privileges and attempted to load DLLs from the directory, this allowed for a DLL hijacking / planting attack.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
CVE-2022-33675
Exploitability windowNot specified
Detection methodsNot specified
References
Discovered by James Sebree (Tenable) site ↗View OCVDB entry ↗
azure-info-disclosureCloudlow
Disclosed 2022-04-05
Azure AD information disclosure via undocumented APIs
azure
Undocumented Azure AD APIs could allow access to internal information of any organization that uses Azure AD. Collected details included licensing information, mailbox information, and directory synchronization status.
Remediation posture derived
Not specifiedDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://www.secureworks.com/research/azure-active-directory-exposes-internal-information
Discovered by an independent researcher (Secureworks) site ↗View OCVDB entry ↗
aws-neuron-sdk-dependency-confusionCloudhigh
Disclosed 2022-04-01 · Published 2024-12-29
AWS Neuron SDK Dependency Confusion Vulnerability Recurs
awsNeuron SDK
AWS Neuron SDK has reintroduced a dependency confusion vulnerability three times in four years. The issue stems from using the --extra-index-url parameter in pip install commands, which allows potential installation of malicious packages from PyPI instead of AWS's private repository. Despite previous reports, AWS has not fully addressed the problem, leaving new packages vulnerable to exploitation.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Use the --index-url parameter instead of --extra-index-url when installing Neuron SDK packages, or utilize a more secure package manager like Poetry. Always verify the source and security of installation instructions, even from reputable sources.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2024/12/29
Detection methodsCheck if Neuron SDK packages are being installed from the correct AWS repository. Verify package integrity and source before installation. Monitor for unexpected or unauthorized package installations in your development environment.
References
- https://giraffesecurity.dev/posts/amazon-hat-trick/
Discovered by an independent researcher (Giraffe Security) site ↗View OCVDB entry ↗
gcp-2022-011Cloudmedium
Disclosure date not specified · Published 2022-03-22
GKE Sandbox side channel attack
gcpGKE Sandbox
There was a misconfiguration with Simultaneous Multi-Threading (SMT), also known as Hyper-threading, in GKE Sandbox images, causing nodes to be potentially exposed to side channel attacks such as Microarchitectural Data Sampling (MDS).
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Upgrade nodes to versions 1.22.6-gke.1500 and later or 1.23.3-gke.1100 and later.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://cloud.google.com/support/bulletins
- https://cloud.google.com/anthos/clusters/docs/security-bulletins
View OCVDB entry ↗
aws-iamadmin-cloudtrail-bypassCloudmedium
Disclosed 2022-03-10 · Published 2023-01-17
AWS CloudTrail bypass for specific IAM actions
awsIAM
Through an undocumented API service called 'iamadmin', attackers could invoke any of 13 read-only IAM actions without the activity being being logged to CloudTrail. These actions included listing group policies (iam:ListGroupPolicies), listing access keys (iam:ListAccessKeys), retrieving information about a role (iam:GetRole), and more. This could have enabled adversaries to perform enumeration and reconnaissance activity undetected after gaining a foothold in a victim AWS environment.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2022/10/24
Detection methodsNot specified
References
- https://securitylabs.datadoghq.com/articles/iamadmin-cloudtrail-bypass/
Discovered by Nick Frichette (Datadog) site ↗View OCVDB entry ↗
synapse-pwnalyticsCloudmedium
Disclosed 2022-03-10 · Published 2022-06-13
Privilege escalation and file poisoning in Synapse Analytics
azureSynapse Analytics
Tenable Research discovered a privilege escalation flaw that allows a user to escalate privileges to that of the root user within the context of a Spark VM. They also discovered a separate flaw that allows a user to poison the hosts file on all nodes in their Spark pool, which would allow an attacker to redirect subsets of traffic and snoop on services users generally do not have access to.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil June 1st, 2022
Detection methodsNot specified
References
Discovered by an independent researcher (Tenable) site ↗View OCVDB entry ↗
cloud-func-gke-bypassCloudmedium
Disclosed 2022-03-09 · Published 2022-06-07
GKE Authorized Networks bypass via Cloud Functions or Cloud Run
gcpGKE
Executing Cloud Functions or Cloud Run in any project and in any organization allowed bypassing the GKE Authorized Networks (aka Kubernetes control plane firewalls) of a cluster in a different project or organization.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Run the following command on existing clusters to block traffic to the GKE control plane from Google Cloud VMs or Cloud Run sourced with Google Cloud public IPs (the same flag can be used at cluster creation time as well): `gcloud container clusters update CLUSTER_NAME --no-enable-google-cloud-access`
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2022/09/30
Detection methodsNot specified
References
Discovered by Peter CollinsView OCVDB entry ↗
azure-logic-app-contributor-escalation-to-root-ownerCloudmedium
Disclosed 2022-03-01 · Published 2022-03-09
Logic Apps privilege escalation to root
azureAzure Logic Apps
Azure Logic Apps use API Connections to authenticate actions to services. Having Contributor access to an Azure Resource Manager (ARM) API Connection would allow someone to create arbitrary role assignments as the connected user. This was supposed to be limited to actions at the Resource Group level, but an attacker could escape to the Subscription or Root level with a path traversal payload. The root cause of this behavior was that such a payload would meet the Swagger API definition, and it would be resolved by the server, resulting in a request to an unintended scope.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://www.netspi.com/blog/technical/cloud-penetration-testing/azure-logic-app-contributor-escalation-to-root-owner/
Discovered by Josh Magri (NetSPI) site ↗View OCVDB entry ↗
cve-2022-29527Cloudhigh
Disclosed 2022-02-28 · Published 2022-04-20
AWS SSM agent local privilege escalation
awsSSMEC2
The Amazon SSM Agent (used for managing EC2 instances via Amazon Systems Manager) created a world-writable sudoers file, which would have allowed local attackers to inject Sudo rules and escalate privileges to root. This could occur in certain situations involving a race condition.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Update the agent to the patched version (3.1.1208)
Related CVEs
CVE-2022-29527
Exploitability windowuntil 2022/04/05
Detection methodsNot specified
References
Discovered by Matthias Gerstner (SUSE) site ↗View OCVDB entry ↗
gcp-8kb-bypassCloudmedium
Disclosed 2022-02-24
Google Cloud Armor packet size bypass
gcpCloud Armor
Cloud Armor has a documented limitation of 8 KB as the maximum size of web request that it will inspect. The default behavior of Cloud Armor in this case can allow oversized malicious requests to bypass Cloud Armor and directly reach an underlying application. Moreover, Cloud Armor does not warn users of this limitation during policy creation or when configuring rules from within the web UI, and can only find a reference to the 8 KB limit in the [Cloud Armor documentation](https://cloud.google.com/armor/docs/security-policy-overview).
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
A custom rule can be added in Advanced mode - `int(request.headers["content-length"]) >= 8192`, with 502, 403, or 404 HTTP response status in return.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowOngoing
Detection methodsNot specified
References
- https://kloudle.com/blog/piercing-the-cloud-armor-the-8kb-bypass-in-google-cloud-platform-waf
- https://kloudle.com/academy/a-guide-to-protect-against-the-8kb-waf-limitation-in-google-cloud-armor
Discovered by Karan Saini, Riyaz Walikar (Kloudle) site ↗View OCVDB entry ↗
acsessedCloudmedium
Disclosed 2022-02-23 · Published 2022-12-22
ACSESSED
azureCognitive Search
Azure Cognitive Search (ACS) is a full-text search engine service. A new non-default feature allowed for a network control to bypassed, permitting an attacker to submit search queries to any other tenant's network-isolated ACS instance. However, abusing this required a valid API key to access the data plane of the target, along with a number of pieces of information about the target environment (such as the subscription ID and the name of the index to query).
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://www.mnemonic.io/resources/blog/acsessed-cross-tenant-network-bypass-in-azure-cognitive-search/
Discovered by Emilien Socchi (mnemonic) site ↗View OCVDB entry ↗
cognito-user-group-spoofingCloudlow
Disclosed 2022-02-15
Cognito User Group spoofing
awsCognitoAmazon API Gateway
Opsmorph discovered an improper access control vulnerability in authorization logic common in applications built on AWS. The vulnerability means a user with permission to create a new Cognito User Group could fool authorization checks into thinking that the user is in any other existing Cognito User Group in the same User Pool, referred to as user group spoofing. When API Gateway is secured with a Cognito User Pool Authorizer it concatenates group names from the identity token into a comma separated string, and as Cognito also permits commas in the group names, this was an ambiguous representation of the groups a user was in that provided an opportunity for injection type attack. AWS have since fixed the Cognito User Pool Authorizer so that it now escapes special characters when parsing the groups claim of the token.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://www.opsmorph.com/Blog/usergroupspoofing
Discovered by an independent researcher (opsmorph) site ↗View OCVDB entry ↗
cve-2022-25165Cloudlow
Disclosed 2022-02-15 · Published 2022-04-12
Privilege Escalation to SYSTEM in AWS VPN Client
awsVPN
The AWS VPN Client application is affected by an arbitrary file write as SYSTEM, which can lead to privilege escalation and an information disclosure vulnerability that allows the user's Net-NTLMv2 hash to be leaked via a UNC path in a VPN configuration file.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Update the client to version 3.0.0.
Related CVEs
CVE-2022-25165
Exploitability windowNot specified
Detection methodsNot specified
References
- https://rhinosecuritylabs.com/aws/cve-2022-25165-aws-vpn-client/
- https://aws.amazon.com/security/security-bulletins/AWS-2022-005/
Discovered by David Yesland (Rhino Security) site ↗View OCVDB entry ↗
apiary-ssrfCloudlow
Disclosed 2022-02-08
Oracle Apiary SSRF
ociApiary
By misusing the Apiary web service and taking advantage of Apiary's use of IMDSv1, a remote attacker is able to retrieve sensitive information from various endpoints and use it to gain more access and sensitive data of other hosts in the same environment.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://orca.security/resources/blog/oracle-server-side-request-forgery-ssrf-attack-metadata/
Discovered by Lidor Ben Shitrit (Orca Security) site ↗View OCVDB entry ↗
codebuild-data-exfilCloudlow
Disclosed 2022-02-03
Codebuild data exfiltration
aws
When customers attach a CodeBuild project to their VPC, CodeBuild’s build container will apply the same network routing rules as defined in the customer’s VPC Security Group. However, CodeBuild EC2 hosts retained Internet connectivity via AWS's own VPC, thus allowing an attacker to bypass any custom VPC rules the customer had set up, and use CodeBuild for data exfiltration from the targeted environment. AWS later updated the CodeBuild service to block all outbound network access for newly created CodeBuild projects which contain a customer-defined VPC configuration.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://awsteele.com/blog/2022/02/03/aws-vpc-data-exfiltration-using-codebuild.html
Discovered by Aidan SteeleView OCVDB entry ↗
gcp-cloudshell-command-injectionCloudmedium
Disclosed 2022-01-28 · Published 2022-08-10
Google Cloud Shell command injection
gcpGoogle Cloud Shell
A vulnerability was discovered in Cloud Shell that enabled command injection and remote shell access. By manipulating the "project" parameter, an attacker could have cause an unencoded Python script execution flaw. Exploiting this flaw, they could inject a command to display the contents of the "/etc/passwd" file, successfully execute arbitrary commands and obtain remote shell access. However, the impact of this is unclear, as an attacker would seemingly only be able to gain such a remote shell on their own instance.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://bugra.ninja/posts/cloudshell-command-injection/
Discovered by Bugra EskiciView OCVDB entry ↗
cloudsql-escapeCloudmedium
Disclosed 2022-01-11 · Published 2022-08-11
Cloud SQL escape to host
gcpazureCloud SQLAzure Database for PostgreSQL
In GCP's case, they introduced a modification to the Cloud SQL's PostgreSQL engine allowing the role assigned to the tenant (cloudsqlsuperuser) to arbitrarily change the ownership of a table to any user or role in the database. Thus, an attacker could (1) create a new table, (2) create an index function with a malicious payload, and (3) change the table owner to GCP’s superuser role (cloudsqladmin). Next, by initiating an ANALYZE command, the malicious function is executed with GCP’s superuser high privileges. Then, an attacker could gain local privilege escalation to root using a symlink attack, and finally, having gained CAP_NET_ADMIN and CAP_NET_RAW capabilities, escape their container via TCP injection of a fake configuration response from the metadata service containing an attacker-controlled SSH key (this is only possible due to the fact that communication with GCP's metadata service is unencrypted and unsigned). A similar bug existed in Azure Database for PostgreSQL, and was part of ExtraReplica's vulnerability chain.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://www.wiz.io/blog/the-cloud-has-an-isolation-problem-postgresql-vulnerabilities
Discovered by Shir Tamari, Nir Ohfeld, Sagi Tzadik, Ronen Shustin (Wiz.io) site ↗View OCVDB entry ↗
extrareplicaCloudcritical
Disclosed 2022-01-11 · Published 2022-04-28
ExtraReplica
azureDatabase for PostgreSQL
A chain of critical vulnerabilities was discovered in Azure Database for PostgreSQL Flexible Server, allowing unauthorized read access to other customers’ PostgreSQL databases, thus bypassing tenant isolation. If exploited, a malicious actor could have replicated and gained read access to Azure PostgreSQL Flexible Server customer databases.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
Discovered by Sagi Tzadik, Nir Ohfeld, Shir Tamari, Ronen Shustin (Wiz) site ↗View OCVDB entry ↗
synlapseCloudcritical
Disclosed 2022-01-04 · Published 2022-05-09
Synlapse
azureSynapse AnalyticsData Factory
Azure Synapse Analytics and Azure Data Factory were vulnerable to cross-tenant access and code execution. This was made possible via a combination of (1) a shell injection RCE vulnerability in the integration runtime, (2) credentials for multiple customers stored on a shared host and (3) an insecure management server API.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
CVE-2022-29972
Exploitability windowNot specified
Detection methodsNot specified
References
Discovered by Tzah Pahima (Orca Security) site ↗View OCVDB entry ↗
gcp-vertex-theia-xssCloudhigh
Disclosed 2022-01-01 · Published 2023-01-15
XSS in Google Cloud Theia notebooks
gcpCloud Vertex AI Workbench
This vulnerability chain exploits a Cross-Site Scripting (XSS) flaw (CVE-2021-41038) within the Theia IDE used in Google Vertex AI Workbench. An attacker could inject malicious JavaScript code into the Theia IDE. This code could then be used to steal the OAuth token associated with the project's default Compute Engine service account, because when a user-managed Vertex AI Workbench instance is created, it utilizes the project's default Compute Engine service account. At the time, this default service account had the Editor Role assigned by default.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None, as the Theia IDE is no longer offered as a Vertex AI experimental image.
Related CVEs
CVE-2021-41038
Exploitability windowNot specified
Detection methodsNot specified
References
- https://blog.geekycat.in/posts/xss-using-postmessage-in-google-cloud-theia-notebooks/
Discovered by Sivanesh Ashok, Sreeram KL site ↗View OCVDB entry ↗
gcp-cloudshell-open-in-command-injectionCloudmedium
Disclosure date not specified · Published 2021-12-28
Google Cloud Shell command injection
gcpCloud Shell
A vulnerability was discovered in Cloud Shell that enabled command injection and remote shell access. The "Open in Cloud Shell" functionality allowed a user to provide values for both the "git_repo" and "go_get_repo" parameters, which would clone the target repo in the user's environment. While "git_repo" was validated against a list of trusted repos, "go_get_repo" was not. Therefore, an attacker could have supplied a trusted repository as "git_repo" and an arbitrary command in the "go_get_repo" parameter. The command would then be executed in a trusted environment where it is possible to access the user's home directory and to perform API calls using the user's credentials. However, the impact of this is unclear, as an attacker would seemingly only be able to gain such a remote shell on their own instance. In theory, phishing could be used to try and coerce a user into running a command that exposed their credentials to the attacker. Google mitigated this issue by preventing users from being able to provide both parameters at once.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2021/01/23
Detection methodsNot specified
References
- https://docs.google.com/document/d/1-TTCS6fS6kvFUkoJmX4Udr-czQ79lSUVXiWsiAED_bs
Discovered by Ademar Nowasky JuniorView OCVDB entry ↗
aws-rds-no-ssl-tlsCloudlow
Disclosed 2021-12-26 · Published 2022-03-10
AWS RDS does not enforce SSL/TLS encryption
awsRDS
The AWS RDS service does not enable secure transport layer security by default, allowing clients to connect insecurely. Additionally, for the more commonly used MySQL and MariaDB RDS engine types, this setting cannot be enabled at all.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
For databases other than MySQL and MariaDB, modify the require_secure_transport or rds.force_ssl values of the attached DB cluster parameter group. For MySQL and MariaDB there is no known workaround, other than ensuring clients connect to these database types only within the VPC. In general, ensure that RDS database instances without SSL/TLS enabled are not exposed over public networks.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowOngoing
Detection methodsNot specified
References
- https://kloudle.com/blog/aws-rds-does-not-force-clients-to-connect-using-a-secure-transport-layer
- https://kloudle.com/academy/fixing-the-default-insecure-network-connection-option-for-rds-instances
Discovered by Riyaz Walikar (Kloudle) site ↗View OCVDB entry ↗
notlegitCloudhigh
Disclosed 2021-12-21 · Published 2021-10-07
Azure NotLegit
azure
Azure App Service had an insecure default behavior that exposed the source code of customer applications written in PHP, Python, Ruby, or Node, that were deployed using “Local Git”.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Remove these permissions - this can be done via an organization policy.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowSept 2017 - Dec 2021
Detection methodsNot specified
References
- https://www.wiz.io/blog/azure-app-service-source-code-leak/
Discovered by Shir Tamari (Wiz) site ↗View OCVDB entry ↗
overprivileged-aws-support-iamCloudmedium
Disclosed 2021-12-21 · Published 2021-12-22
Overprivileged AWS support IAM role policy
aws
AWS added an excessive s3:getObject permission to AWSSupportServiceRolePolicy IAM policy used by AWS Support teams, and removed it a day later.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required, though best practice would be to use KMS-CMK for bucket encryption and minimize privileges in resource policies.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://aws.amazon.com/security/security-bulletins/AWS-2021-007/
- https://twitter.com/0xdabbad00/status/1473448889948598275
Discovered by Scott Piper (Summit Route) site ↗View OCVDB entry ↗
log4shell-hotpatchCloudhigh
Disclosed 2021-12-14 · Published 2022-04-19
Log4Shell Hot Patch Vulnerable to Container Escape and Privilege Escalation
aws
AWS's hotpatches for Log4shell worked as intended but introduced new container escape vulnerabilities.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
CVE-2021-3100CVE-2021-3101CVE-2022-0070CVE-2022-0071
Exploitability windowNot specified
Detection methodsNot specified
References
- https://unit42.paloaltonetworks.com/aws-log4shell-hot-patch-vulnerabilities/
- https://aws.amazon.com/security/security-bulletins/AWS-2022-006/
Discovered by Yuval Avrahami (Palo Alto) site ↗View OCVDB entry ↗
aws-rds-local-file-readCloudhigh
Disclosed 2021-12-09 · Published 2022-04-11
AWS RDS local file read
awsRDS
A vulnerability was discovered in the Aurora PostgreSQL log_fdw extension for Amazon Relational Database Service (RDS), allowing an attacker to read files on the EC2 host and obtain credentials for an internal AWS service.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://blog.lightspin.io/aws-rds-critical-security-vulnerability
- https://aws.amazon.com/security/security-bulletins/AWS-2022-004/
Discovered by Gafnit Amiga (Lightspin) site ↗View OCVDB entry ↗
autowarpCloudcritical
Disclosed 2021-12-06 · Published 2022-03-07
AutoWarp
azureAutomation Service
An exposed endpoint in the Azure Automation Service allowed to steal Azure API credentials from other customers
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required. As a general practice, use the least-privilege principle, including on managed identities assigned to automation accounts. While this would not have prevented the leakage of API credentials, it would have reduced the blast radius.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://orca.security/resources/blog/autowarp-microsoft-azure-automation-service-vulnerability/
Discovered by Yanir Tsarimi (Orca Security) site ↗View OCVDB entry ↗
sagemaker-jupyter-csrfCloudmedium
Disclosed 2021-12-02
AWS SageMaker Jupyter Notebook instance CSRF
awsSageMaker Jupyter Notebook
AWS SageMaker Notebook server lacked a check of the Origin header that led to a CSRF vulnerability. An attacker could have read sensitive data and execute arbitrary actions in customer environments. The exact same issue existed in GCP previously.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://blog.lightspin.io/aws-sagemaker-notebook-takeover-vulnerability
Discovered by Gafnit Amiga (Lightspin) site ↗View OCVDB entry ↗
aws-fall-2021-soc2CloudSeverity not specified
Disclosed 2021-11-15
AWS SOC 2 type 2 failure (Fall 2021)
aws
Information about this issue is under NDA, but AWS customers can read about it on page 98 of the report, which is available for download through AWS Artifact. Note: This issue is outside the scope of this database's usual criteria for inclusion, but has been kept for historic reasons, as it was included in the original CSP Security Mistakes dataset.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://aws.amazon.com/blogs/security/fall-2021-soc-reports-now-available-with-141-services-in-scope/
View OCVDB entry ↗
aws-api-gw-smugglingCloudlow
Disclosed 2021-11-10
AWS API Gateway HTTP header smuggling
awsAPI Gateway
A flaw in AWS API Gateway enabled hiding HTTP request headers. Tampering with HTTP requests visibility enabled bypassing IP restrictions, cache poisoning and request smuggling.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://www.intruder.io/research/practical-http-header-smuggling
Discovered by Daniel Thatcher (intruder) site ↗View OCVDB entry ↗
dependency-confusion-in-aws-codeartifactCloudmedium
Disclosed 2021-10-29 · Published 2022-07-14
Dependency confusion in AWS CodeArtifact
awsCodeArtifact
AWS CodeArtifact was susceptible to dependency confusion / substitution (i.e, publication of a malicious package to a public repository with the same name as an organization’s internal package). AWS fixed this issue by adding package origin controls, allowing users to limit how versions of a given package can be added to a CodeArtifact repository.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
Discovered by Ignacio Dominguez (Zego) site ↗View OCVDB entry ↗
s3-replicator-cloudtrailCloudlow
Disclosed 2021-10-19 · Published 2022-07-20
S3 Replication only logs first destination bucket
awsS3
If a malicious actor with prior access to an AWS environment has permission to modify the S3 Replication Service role access policy, they could abuse cross-account replication to exfiltrate stolen data to an external bucket under their control. Moreover, when configured to replicate to multiple buckets at once, and if logging is only scoped to specific buckets (as opposed to being set to log "all current and future buckets"), then the S3 Replication Service only logs a putObject event to CloudTrail for the first destination bucket. Thus, as long as the malicious actor's bucket isn't the first replication destination, their activity wouldn't be logged in CloudTrail, and might go undetected.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowongoing
Detection methodsMonitor for changes to Replication rules (e.g., via the S3BucketChangesAlarm alert in CloudWatch) and note any suspicious destinations.
References
- https://www.vectra.ai/blogpost/abusing-the-replicator-silently-exfiltrating-data-with-the-aws-s3-replication-service
- https://www.youtube.com/watch?v=9lvLboXE9tw
Discovered by Kat TraxlerView OCVDB entry ↗
cve-2021-42306Cloudhigh
Disclosed 2021-10-07 · Published 2021-11-17
CredManifest (Azure AD keyCredential property information disclosure)
azureAAD
Automation Account 'Run as' credentials (PFX certificates) were being stored in cleartext, in Azure Active Directory (AAD). These credentials were available to anyone with the ability to read information about App Registrations (typically most AAD users).
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Regenerate exposed certificate
Related CVEs
CVE-2021-42306
Exploitability windowNot specified
Detection methodsNot specified
References
Discovered by Karl Fosaaen (NetSPI) site ↗View OCVDB entry ↗
superglueCloudcritical
Disclosed 2021-09-30 · Published 2022-01-13
SuperGlue
awsGlue
Compromise of internal AWS Glue service to assume the glue role in any AWS account that used glue.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://orca.security/resources/blog/aws-glue-vulnerability/
- https://aws.amazon.com/security/security-bulletins/AWS-2022-002/
Discovered by Yanir Tsarimi (Orca Security) site ↗View OCVDB entry ↗
gcp-2021-019Cloudlow
Disclosure date not specified · Published 2021-09-29
Dropped active Google Cloud Armor security policy
gcpCloud Armor
There is a known issue where updating a BackendConfig resource using the v1beta1 API removes an active Google Cloud Armor security policy from its service. If you do not configure Google Cloud Armor on your Ingress resources via the BackendConfig, then this issue does not affect your clusters.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Dropped Cloud Armor security policies must be manually reattached.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://cloud.google.com/support/bulletins
- https://cloud.google.com/anthos/clusters/docs/security-bulletins
View OCVDB entry ↗
gcp-2021-022Cloudlow
Disclosure date not specified · Published 2021-09-22
Predictible seed in Anthos Identity Service LDAP module
gcpAnthos
A vulnerability was discovered in the Anthos Identity Service (AIS) LDAP module of Anthos clusters on VMware versions 1.8 and 1.8.1 where a seed key used in generating keys is predictable. With this vulnerability, an authenticated user could add arbitrary claims and escalate privileges indefinitely.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Upgrade your clusters to version 1.8.2.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowOngoing
Detection methodsNot specified
References
- https://cloud.google.com/support/bulletins
- https://cloud.google.com/anthos/clusters/docs/security-bulletins
View OCVDB entry ↗
cve-2021-38112Cloudhigh
Disclosed 2021-09-21
AWS Workspace client RCE
awsWorkspaces
If a user with AWS WorkSpaces 3.0.10-3.1.8 installed visits a page in their web browser with attacker controlled content, the attacker can get zero click RCE under common circumstances.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Update client to 3.1.9 or higher
Related CVEs
CVE-2021-38112
Exploitability windowNot specified
Detection methodsNot specified
References
- https://rhinosecuritylabs.com/aws/cve-2021-38112-aws-workspaces-rce/
- https://nvd.nist.gov/vuln/detail/CVE-2021-38112
Discovered by David Yesland (Rhino Security) site ↗View OCVDB entry ↗
gcp-iap-bypassCloudmedium
Disclosed 2021-09-17
GCP IAP bypass
gcp
Convincing a victim to click a specially crafted link would allow the attacker to bypass the Identity-Aware Proxy (a core component of BeyondCorp).
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://cloud.google.com/support/bulletins
Discovered by UnknownView OCVDB entry ↗
omigodCloudcriticalExploited in the wild
Disclosed 2021-09-14 · Published 2021-06-01
OMIGOD
azureOMI
Azure forces the install of an agent on Linux VMs, which contained a vulnerability that would grant root RCE if an attacker could send a web request to them. Initially, Microsoft did not update the agent automatically, and so customers had to patch manually, but a few days later they began patching some services remotely.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Customers must update vulnerable extensions for their cloud and on-premises deployments. New VMs in a region are protected from these vulnerabilities as they are created. For cloud deployments, Microsoft has deployed the updates to extensions across Azure regions. The automatic extension updates were transparently patched without a reboot. Where possible, customers should ensure that automatic extension updates are enabled.
Related CVEs
CVE-2021-38647 CVE-2021-38648 CVE-2021-38645 CVE-2021-38649
Exploitability windowNot specified
Detection methodsOMI version < 1.6.8.1
References
Discovered by Nir Ohfeld (Wiz) site ↗View OCVDB entry ↗
azurescapeCloudcritical
Disclosed 2021-09-09
Azurescape
azureACI
Cross-account container escape
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Revoking any privileged credentials that were deployed to the platform before Aug. 31, 2021, and checking their access logs for irregularities.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://unit42.paloaltonetworks.com/azure-container-instances/
Discovered by Yuval Avrahami (Palo Alto) site ↗View OCVDB entry ↗
breakingformationCloudcritical
Disclosed 2021-09-09 · Published 2022-01-13
BreakingFormation
awsCloudFormation
Read access of host of AWS internal Cloudformation service via XXE SSRF. The level of access with the compromised IAM role from there is unclear.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
Discovered by Tzah Pahima (Orca Security) site ↗View OCVDB entry ↗
chaosdbCloudcritical
Disclosed 2021-08-09 · Published 2021-08-26
ChaosDB
azureCosmos DB
Azure's Cosmos DB database service was vulnerable to remote account takeover. Any Azure user could gain full admin access to other customers' Cosmos DB instances without authorization. The vulnerability had a trivial exploit that doesn't require any previous access to the target environment.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Regenerate primary read/write key.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability window2017 - 2021
Detection methodsNot specified
References
Discovered by Nir Ohfeld, Sagi Tzadik (Wiz) site ↗View OCVDB entry ↗
lightsail-keys-loggedCloudmedium
Disclosed 2021-08-05
Lightsail object storage access keys logged
awsLightsail
Lightsail object storage allows the creation of access keys which were logged to CloudTrail (both access key and secret key)
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Roll access keys
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://summitroute.com/blog/2021/08/05/lightsail-object-storage-concerns-part-1/
Discovered by Scott Piper (Summit Route) site ↗View OCVDB entry ↗
aad-seamless-sso-log-bypassCloudlow
Disclosed 2021-06-29 · Published 2021-09-29
Azure AD Seamless SSO logging bypass
azureAzure AD Seamless SSO
Azure Active Directory Seamless Single Sign-On feature allowed single-factor brute-force attacks against Azure AD without generating sign-in events in the targeted organization’s tenant.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://www.secureworks.com/research/undetected-azure-active-directory-brute-force-attacks
Discovered by an independent researcher (Secureworks) site ↗View OCVDB entry ↗
gke-autopilot-allowlistCloudmedium
Disclosed 2021-06-01 · Published 2022-03-08
Autopilot node compromise via allowlisted workload masquerade
gcpAutopilot
Unit 42 researchers disclosed several vulnerabilities and attack techniques in GKE Autopilot to Google, the root cause being insufficient verification of allowlisted workload image names. An attacker with permissions to create a pod could have abused these vulnerabilities to (1) escape their pod and compromise the underlying node, (2) escalate privileges and become full cluster administrators, and (3) covertly persist administrative access through backdoors that are completely invisible to cluster operators.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
Discovered by Yuval Avrahami (Palo Alto) site ↗View OCVDB entry ↗
eks-logged-serviceaccount-tokens-plaintextCloudhigh
Disclosed 2021-05-30 · Published 2025-02-26
AWS EKS Logged ServiceAccount Tokens in Plaintext
awsEKS
AWS EKS was logging ServiceAccount tokens in plaintext, including those used for AssumeRoleWithWebIdentity and connecting to the Kubernetes API server. This issue affected clusters between March 2020 and May 2021, potentially exposing sensitive credentials in CloudWatch logs.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Add deny entries for CloudWatch EKS logs to all human roles without secondary approval in production. Implement dual control for accessing these logs when necessary.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2021/05/30
Detection methodsMonitor CloudWatch logs for EKS clusters and search for JWT-like strings beginning with "eyJhb". Implement logging restrictions and access controls on EKS audit logs.
References
- https://gist.github.com/lnattrass/7c5dcf420821db20a058b663d7ff9827
View OCVDB entry ↗
gcp-org-policies-bypassCloudmedium
Disclosed 2021-05-15 · Published 2021-09-10
Org policies bypass
gcp
Allows an attacker with privileges in the account to share resources outside of the account even when an org policy restricts this, thus enabling them to backdoor their access.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://kattraxler.github.io/gcp/hacking/2021/09/10/gcp-org-policy-bypass-ai-notebooks.html
Discovered by Kat TraxlerView OCVDB entry ↗
iap-bypass-google-cloudCloudhigh
Disclosed 2021-05-05 · Published 2021-12-30
Bypassing Identity-Aware Proxy in Google Cloud
gcpIdentity-Aware Proxy
A vulnerability in Google Cloud Platform's Identity-Aware Proxy (IAP) allowed attackers to bypass authentication and access IAP-secured web applications. The exploit involved creating a malicious IAP-secured app using the target's OAuth client ID, configuring query parameter-based routing to capture redirect tokens, and using these tokens to hijack authorized sessions.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required. The vulnerability has been fixed by Google.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2021/06
Detection methodsMonitor for unauthorized access to IAP-secured applications. Review IAP logs for suspicious authentication attempts or unexpected redirect patterns.
References
- https://www.seblu.de/2021/12/iap-bypass.html
Discovered by SebLuView OCVDB entry ↗
eltima-cloud-desktop-lpeCloudhigh
Disclosed 2021-05-02 · Published 2021-12-07
LPE vulnerability in Eltima (3rd-party cloud desktop driver)
awsWorkSpaces
Several cloud desktop solutions rely on a 3rd-party library called Eltima SDK to provide USB over Ethernet capabilities, to allow users to connect and share local devices such as webcams. SentinelLabs discovered vulnerabilities in Eltima drivers, including proprietary versions used by several cloud services (among them AWS Workspaces), that would allow unprivileged users to escalate privileges to kernel mode.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
AWS Workspaces users must manually update if they have either AutoStop WorkSpaces with maintenance disabled or AlwaysOn WorkSpaces with OS updates disabled.
Related CVEs
CVE-2021-42972CVE-2021-42973CVE-2021-42976CVE-2021-42977CVE-2021-42979CVE-2021-42980CVE-2021-42983CVE-2021-42986CVE-2021-42987CVE-2021-42988CVE-2021-42990CVE-2021-42993CVE-2021-42994CVE-2021-42996CVE-2021-43000CVE-2021-43002CVE-2021-43003CVE-2021-43006CVE-2021-43637CVE-2021-43638CVE-2021-42681CVE-2021-42682CVE-2021-42683CVE-2021-42685CVE-2021-42686CVE-2021-42687CVE-2021-42688
Exploitability windowNot specified
Detection methodsNot specified
References
- https://www.sentinelone.com/labs/usb-over-ethernet-multiple-privilege-escalation-vulnerabilities-in-aws-and-other-major-cloud-services/
Discovered by Kasif Dekel (SentinelOne) site ↗View OCVDB entry ↗
dialogflow-privilege-escalationCloudhigh
Disclosed 2021-04-06 · Published 2021-06-13
Privilege escalation on Dialogflow cloud platform
gcpDialogflow
A privilege escalation vulnerability was discovered in Google's Dialogflow cloud platform. When downgrading a user's role from Developer to Reviewer, the permissions were not properly updated, allowing the user to retain Developer-level access. This issue persisted in the Google Cloud Console, where role changes resulted in additive permissions instead of replacements.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2021/06/13
Detection methodsAdministrators can verify user permissions in the Google Cloud Console IAM section to ensure they match the intended access levels set in Dialogflow.
References
- https://0x01alka.medium.com/google-vrp-privilege-escalation-on-https-dialogflow-cloud-google-com-599af6c4516d
Discovered by lalkaView OCVDB entry ↗
aws-cognito-reset-vulnerabilityCloudhigh
Disclosed 2021-03-22 · Published 2021-04-30
Password Reset Code Brute-Force Vulnerability in AWS Cognito
awsCognito
A vulnerability in AWS Cognito's password reset function allowed attackers to brute-force the six-digit reset code, potentially leading to account takeovers. Using concurrent HTTP requests, an attacker could make up to 1587 guesses instead of the documented limit of 20. The issue affected accounts without multi-factor authentication and was fixed by AWS on April 20, 2021.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Enable multi-factor authentication for AWS Cognito accounts. AWS customers can implement their own rate-limiting before sending requests to AWS Cognito.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2021/04/20
Detection methodsMonitor for unusual patterns of password reset attempts on AWS Cognito accounts, particularly those involving a high number of failed attempts in a short period.
References
- https://www.pentagrid.ch/en/blog/password-reset-code-brute-force-vulnerability-in-AWS-Cognito/
Discovered by Tobias Ospelt (Pentagrid AG) site ↗View OCVDB entry ↗
aws-xss-consoleCloudlow
Disclosed 2021-03-13 · Published 2021-06-03
Elastic Beanstalk - XSS in Web Console
awsAWS Management Console
An adversary could gain access to IAM credentials in a victim's account, and make an API request to Elastic Beanstalk (even if they didn't have the proper IAM permissions). This request would be displayed in the management console in the Elastic Beanstalk section. Due to improper sanitization, an attacker could insert an XSS payload that would execute in a victim's browser.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowMarch 2021 - June 2021
Detection methodsNot specified
References
- https://twitter.com/Frichette_n/status/1400517723910819844
- https://frichetten.com/blog/xss_in_aws_console/
Discovered by Nick Frichette site ↗View OCVDB entry ↗
cve-2021-27075Cloudmedium
Disclosed 2021-03-09
Azure Linux VM extension credential leak
azureAzure Container InstanceAzure Service FabricAzure Kubernetes ServiceAzure Container RegistryAzure Spring Cloud
A vulnerability in the Azure Linux VM extension mechanism allowed an unprivileged user to leak any Azure VM extension’s private data. An attacker could have abused this to gain credentials for the VM itself as well as credentials for extensions associated with the VM. Paired with the design of the VMAccess extension (an official Azure extension for managing VM credentials), this could have been used to achieve privilege escalation, as an unprivileged attacker would have been able to elevate themselves to a higher privileged user by leaking the VMAccess admin password. Additionally, if the VMAccess password happened to be shared among other Azure VMs, the attacker would have been able to perform lateral movement to other machines. The root cause of this vulnerability was that the certificates endpoint used for decrypting extension credentials did not validate transport certificates, so an attacker could simply issue their own valid transport certificate. Moreover, although an iptables rule was in place to prevent unprivileged access to this endpoint, an attacker could bypass it by directing their requests to the Azure IMDS instead, which happened to be located on the same machine as the certificates endpoint.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
For Azure Kubernetes Service, update to image version 2020.10.15 or later. For other services, no action is required.
Related CVEs
CVE-2021-27075
Exploitability windowNot specified
Detection methodsNot specified
References
- https://www.intezer.com/blog/cloud-security/cve-2021-27075-microsoft-azure-vulnerability-allows-privilege-escalation-and-leak-of-data/
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-27075
Discovered by Paul Litvak (Intezer), Wouter ter Maat (Offensi)View OCVDB entry ↗
dataflow-rce-jmxCloudlow
Disclosed 2021-03-05 · Published 2021-12-28
Dataflow RCE via unauthenticated JMX service
gcpDataflow
Dataflow worker nodes ran an unauthenticated Java Management Extensions (JMX) service that under certain circumstances would be exposed to the Internet, thus allowing unauthenticated remote code execution (RCE) as root in an unprivileged container. The impact of the vulnerability depended on which service account qA assigned to Dataflow worker nodes (by default, that would be the Google Compute Engine default service account, which has the project-wide Editor role assigned).
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://mbrancato.github.io/2021/12/28/rce-dataflow.html
- https://portswigger.net/daily-swig/google-showers-top-cloud-security-researchers-with-kudos-and-cash
Discovered by Mike Brancato site ↗View OCVDB entry ↗
azure-b2c-crypto-flawCloudcritical
Disclosed 2021-03-01 · Published 2023-02-15
Azure AD B2C cryptographic flaw allowing account compromise
azureAD B2C
Azure Active Directory B2C service (AD B2C) mistakenly implemented RSA key authentication using the public part of the key pair instead of the private one. This cryptographic flaw could have allowed an unauthenticated attacker to craft an OAuth refresh token for any AD B2C user account if they knew their public key. Moreover, every AD B2C user's public key was recoverable through an unrelated vulnerability (though asymmetric cryptography should not rely on public key secrecy regardless). An attacker could redeem this refresh token for a session token, thereby gaining access to the victim account as if they had logged in through a legitimate login flow.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required, but AD B2C tenant administrators should perform a key rotation and/or switch to symmetric cryptography (e.g., AES).
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil December 22'
Detection methodsNot specified
References
- https://www.praetorian.com/blog/azure-b2c-crypto-misuse-and-account-compromise/
Discovered by John Novak (Praetorian) site ↗View OCVDB entry ↗
azure-devops-dangling-domainCloudmedium
Disclosed 2021-02-18 · Published 2022-11-07
Azure Devops account takeover via dangling subdomain takeover
azureDevOps
Binary Security discovered and registered two dangling cloudapp.azure.com subdomains corresponding to subdomains at visualstudio.com. Had these been discovered and registered by an attacker, this would have been equivalent to a 1-click vulnerability for Azure DevOps: the attacker could have crafted a URL referring to the sign-in API for Azure DevOps Services (app.vssps.visualstudio.com) using one of the two subdomains in the "reply_to" field (since subdomains of visualstudio.com would be allowed by the API). If clicked on by a target Azure DevOps user, this would have sent an authentication token to an attacker-controlled server, thereby allowing account takeover.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://www.binarysecurity.no/posts/2022/11/azure-devops-takeover
Discovered by Christian August Holm Hansen (Binary Security) site ↗View OCVDB entry ↗
aws-cloudshell-terminal-escapeCloudmedium
Disclosed 2021-02-08 · Published 2021-03-10
AWS CloudShell terminal escape
awsCloudshell
If attacker controlled data is viewed in Cloudshell it could have led to code execution. This exact same issue existed in Azure previously.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://bugs.chromium.org/p/project-zero/issues/detail?id=2154
- https://twitter.com/_fel1x/status/1391712232380194818
Discovered by Felix Wilhelm (Google)View OCVDB entry ↗
elb-cache-http-smugglingCloudmedium
Disclosed 2021-01-24 · Published 2022-05-17
ELB Cache mechanism HTTP header smuggling
awsELB
While testing rate-limiter protection, The researcher noticed that when forcing HTTP/1 requests and injecting a space after `X-Forwarded-For` he was able to override this specific header, letting him impersonate any IP. Any internal header could have beem overridden, also the one that should not be exposed/forwarded by the client, such as `CloudFront-Viewer-Country-Region` or any other `CloudFront` enhanced header. This special security issue was affecting all AWS users with that a specific setting enabled.
Remediation posture derived
Not specifiedDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowFixed on 2022/01/29
Detection methodsNot specified
References
- https://twitter.com/nJoyneer/status/1526593840928411650
- https://raw.globalsecuritydatabase.org/GSD-2022-1002524
Discovered by Andrea Brancaleoni (Brave) site ↗View OCVDB entry ↗
cloud-sql-vulns-google-rdsCloudhigh
Disclosed 2021-01-21 · Published 2021-10-18
Cloud SQL vulnerabilities in Google's RDS offering
gcpCloud SQLCloud SQL Auth Proxy
Multiple vulnerabilities were found in Google Cloud SQL, including config file injection leading to RCE, information disclosure in the Cloud SQL Auth Proxy, and a design issue in Postgres IAM authentication allowing access token theft. Other issues included GCR permission misconfigurations and potential for terminal escape sequence injection attacks via gcloud.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Upgrade Cloud SQL Auth Proxy clients to force TLSv1.3. Review and restrict permissions on GCR repositories. Consider disabling MySQL LOAD DATA LOCAL feature.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsMonitor for unexpected Cloud SQL instance access or configuration changes. Review Cloud SQL Auth Proxy logs for anomalous connection attempts.
References
- https://irsl.medium.com/dropping-a-shell-in-googles-cloud-sql-the-speckle-umbrella-story-f9375bd4960d
- https://irsl.medium.com/the-speckle-umbrella-story-part-2-fcc0193614ea
Discovered by Imre RadView OCVDB entry ↗
gke-gvisor-sandbox-escapeCloudmedium
Disclosed 2020-12-30
GKE gVisor sandbox escape
gcpGKE
A bug in the GKE gVisor sandbox's network policy implementation allowed access to the Google Compute Engine metadata API.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://www.koyeb.com/blog/escaping-gke-gvisor-sandboxing-using-metadata
Discovered by Bastien Chatelard (Koyeb) site ↗View OCVDB entry ↗
aws-fall-2020-soc2CloudSeverity not specified
Disclosed 2020-12-20
AWS SOC 2 type 2 failure (Fall 2020)
aws
Information about this issue is under NDA, but AWS customers can read about it on pages 120-121 of the report, which is available for download through AWS Artifact. Note: This issue is outside the scope of this database's usual criteria for inclusion, but has been kept for historic reasons, as it was included in the original CSP Security Mistakes dataset.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://aws.amazon.com/blogs/security/fall-2020-soc-reports-now-available-with-124-services-in-scope/
View OCVDB entry ↗
gcp-default-compute-accountCloudmedium
Disclosure date not specified · Published 2020-11-22
GCP Default compute account is project Editor
gcp
When the compute API is enabled on a GCP Project, the default compute account is created. This account gets the primitive role Editor assigned by default, which allows for a wide variety of privilege excalation and resource abuse in the project. Especially, all new VMs created inherit this permissions by default. This issue is arguably a technical decision by GCP, but the documents advise customers to undo this.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Remove these permissions, it can be done via an organization policy
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowSince the creation of GCP
Detection methodsNot specified
References
- https://cloud.google.com/resource-manager/docs/organization-policy/restricting-service-accounts
Discovered by Louis Duruflé-Seta site ↗View OCVDB entry ↗
ssrf-in-google-cloud-monitoringCloudmedium
Disclosure date not specified · Published 2020-11-12
SSRF in Google Cloud Monitoring
gcpGoogle Cloud Monitoring
An SSRF bug in Google Cloud Monitoring's uptime check feature could have been used to leak the authentication token of the service account used for these checks. The issue was resolved but later bypassed by Omar Espino (@omespino), requiring another fix.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://nechudav.blogspot.com/2020/11/31k-ssrf-in-google-cloud-monitoring.html
- https://omespino.com/write-up-google-vrp-n-a-ssrf-bypass-with-quadzero-in-google-cloud-monitoring/
Discovered by David Nechuta site ↗View OCVDB entry ↗
aws-route-table-modifyCloudlow
Disclosed 2020-10-19
Route table modification to imitate metadata service
aws
An attacker with sufficient privileges in AWS to modify the route table and some other EC2 privileges, could pretend to be a metadata server and provide an attacker controlled bootup script to EC2s to move laterally.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://github.com/RyanJarv/EC2FakeImds
- https://blog.ryanjarv.sh/2020/10/19/imds-persistence.html
Discovered by Ryan GerstenkornView OCVDB entry ↗
iam-managed-policies-lack-controlsCloudlow
Disclosed 2020-10-15
Lack of internal change controls for IAM managed policies
aws
AWS have released or changed managed IAM policies in unexpected and insecure ways. Examples include: CheesepuffsServiceRolePolicy, AWSServiceRoleForThorInternalDevPolicy, AWSCodeArtifactReadOnlyAccess.json, AmazonCirrusGammaRoleForInstaller. The worst being the ReadOnlyAccess policy having almost all privileges removed and unexpected ones added.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://twitter.com/__steele/status/1316909785607012352
View OCVDB entry ↗
log-analytics-role-privescCloudmedium
Disclosed 2020-10-15 · Published 2021-09-13
Azure privilege escalation via Log Analytics role
azureLog Analytics
Azure AD users could escalate their privileges using the Log Analytics Contributor role to reach the full Subscription Contributor role.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://www.netspi.com/blog/technical/cloud-penetration-testing/escalating-azure-privileges-with-the-log-analystics-contributor-role/
Discovered by Karl Fosaaen (NetSPI) site ↗View OCVDB entry ↗
gcp-org-policy-exfiltrate-dataCloudlow
Disclosed 2020-10-12 · Published 2021-09-22
Exfiltrate data via the logs of GCP Org policy
gcp
Upon blocking a request, GCP Org policy constraints were logging the deny logs in Principal''s project and the blocking project. An attacker could use those logs to exfiltrate any data, by making request from a Principal they own from a defender project.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Review denied logs in the defender project, because it was also logged there.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://trustoncloud.com/exfiltrate-data-from-your-super-secure-google-cloud-project-using-the-security-control-built-to-prevent-it/
Discovered by Jonathan Rault (TrustOnCloud) site ↗View OCVDB entry ↗
encryption-sdk-issuesCloudlow
Disclosed 2020-09-28
Encryption SDK vulnerabilities
awsKMS
AWS KMS and all versions of AWS Encryption SDKs prior to version 2.0.0 were susceptible to information leakage (an attacker could create ciphertexts that would leak the user’s AWS account ID, encryption context, user agent, and IP address upon decryption), ciphertext forgery (an attacker could create ciphertexts that were accepted by other users) and lack of robustness (an attacker could create ciphertexts that decrypt to different plaintexts for different users).
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Update the SDK to the latest secure version.
Related CVEs
CVE-2020-8897
Exploitability windowNot specified
Detection methodsNot specified
References
- https://twitter.com/XorNinja/status/1310587707605659649
- https://vnhacker.blogspot.com/2020/09/advisory-security-issues-in-aws-kms-and.html
Discovered by Thai Duong (thaidn) (Google)View OCVDB entry ↗
s3-bucket-tagging-not-restrictedCloudlow
Disclosed 2020-09-28
S3 bucket tagging not restricted
awsS3
Lack of the privilege s3:PutBucketTagging did not restrict the ability to tag S3 buckets.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://onecloudplease.com/blog/security-september-still-early-days-for-abac
Discovered by Ian MckayView OCVDB entry ↗
dhcp-abuse-code-execCloudmedium
Disclosed 2020-09-26 · Published 2021-06-25
DHCP abuse for code exec
gcp
Under certain conditions, an attacker can flood DHCP packets to the victim VM, allowing it to impersonate the Metadata server, and grant themselves SSH access.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://github.com/irsl/gcp-dhcp-takeover-code-exec
Discovered by Imre RadView OCVDB entry ↗
cloudformer-reviewCloudlow
Disclosed 2020-09-25
CloudFormer review
awsCloudFormer
An audit of an AWS open-source project identified a great deal of issues, and as a result AWS made the decision to take it down.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://blog.karims.cloud/2020/09/25/cloudformer-review-part-1.html
Discovered by Karim El-Melhaoui (O3 Cyber) site ↗View OCVDB entry ↗
lambda-cloudwatch-timing-attackCloudlow
Disclosed 2020-09-15
Timing attack with Lambda and CloudWatch Synthetics
awsLambdaCloudWatch Synthetics
The immutability of Lambda versions could be violated via a timing attack against CloudWatch Synthetics canaries.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://onecloudplease.com/blog/security-september-racing-against-cloudwatch-synthetics-canaries
Discovered by Ian MckayView OCVDB entry ↗
privilege-identification-cloudtrailCloudlow
Disclosed 2020-09-02 · Published 2020-10-17
Enumeration of Privileges Without Being Logged to CloudTrail
awsCloudTrail
An attacker who gained access to IAM credentials could enumerate a subset of the privileges they had access to without logging to CloudTrail. This would allow them to perform the typically noisy permission enumeration process undetected.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowuntil 2021/05/18
Detection methodsNot specified
References
- https://frichetten.com/blog/aws-api-enum-vuln/
- https://github.com/Frichetten/aws-stealth-perm-enum
Discovered by Nick Frichette site ↗View OCVDB entry ↗
cloudformation-dosCloudlow
Disclosed 2020-09-01
CloudFormation denial of service (in a single account)
awsCloudFormation
An attacker with the ability to create CloudFormation stacks could cause a denial-of-service on some CloudFormation actions within a single AWS account.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNone.
References
- https://onecloudplease.com/blog/security-september-fun-with-fncidr
Discovered by Ian MckayView OCVDB entry ↗
cloud-sql-shell-dropCloudcritical
Disclosure date not specified · Published 2020-08-18
Dropping a Shell in Google Cloud SQL
gcpCloud SQL
Researchers discovered vulnerabilities in Google Cloud SQL that allowed gaining unauthorized shell access to MySQL instances. By chaining SQL injection, parameter injection in mysqldump, and network spoofing, they were able to escape a Docker container and gain full access to the host VM running Cloud SQL.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required. Google patched the vulnerabilities.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsMonitor for suspicious export operations and network activity on Cloud SQL instances. Review logs for anomalous mysqldump commands or container escapes.
References
- https://www.ezequiel.tech/2020/08/dropping-shell-in.html
- https://offensi.com/2020/08/18/how-to-contact-google-sre-dropping-a-shell-in-cloud-sql/
Discovered by Ezequiel Pereira and Wouter ter MaatView OCVDB entry ↗
google-cloud-shell-bugsCloudhigh
Disclosure date not specified · Published 2020-08-18
Google Cloud Shell Bugs Expose User Credentials
gcpCloud ShellCloud Run
Three vulnerabilities in Google Cloud Shell were discovered, allowing attackers to execute arbitrary code and potentially steal user credentials. The bugs affected Ruby gemspec parsing, TypeScript plugin loading, and Go binary path manipulation in Cloud Run. These issues arose from mismatches between Cloud Shell's threat model and the assumptions of its underlying open-source components.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsMonitor for suspicious activity in Cloud Shell instances, especially unexpected code execution or credential access. Review logs for unusual repository cloning or file access patterns.
References
- https://blog.daviddworken.com/posts/cloud-shell-bugs-explained/
Discovered by David DworkenView OCVDB entry ↗
gcp-service-accounts-leakCloudmedium
Disclosed 2020-08-08 · Published 2020-08-26
GCP service accounts and projects information leak
gcpIAMProjects
It was possible to list IAM service accounts of any GCP project, given only its ID, by forging a pageToken for the projects.serviceAccounts.list method of the IAM API. Due to the design of certain services in GCP, this issue could lead to exposure of sensitive information related to a project, and could be further used to enumerate unsecured resources in the platform, such as App Engine apps, Container Registry repositories, etc.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://www.ezequiel.tech/2020/08/leaking-google-cloud-projects.html
Discovered by Ezequiel Pereira site ↗View OCVDB entry ↗
aws-s3-recon-account-id-of-bucketCloudlow
Disclosed 2020-07-27
CloudTrail S3 data events leak bucket Account ID
awsS3
Using CloudTrail S3 data events, it was possible to determine the AWS account ID of any existing S3 bucket by calling any S3 API, getting denied, and looking at the value in the resource key in error message that showed up in CloudTrail.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowuntil 2022/07/08
Detection methodsNot specified
References
- https://twitter.com/trustoncloud/status/1549005011463446528
- https://github.com/trustoncloud/threatmodel-for-aws-s3
Discovered by Jonathan Rault (TrustOnCloud) site ↗View OCVDB entry ↗
aws-auth-multiple-issuesCloudlow
Disclosed 2020-07-15 · Published 2020-10-06
Multiple issues in AWS IAM Authenticator for Kubernetes
awsEKS
Amazon Elastic Kubernetes Service (EKS) uses IAM to provide authentication to the cluster through the AWS IAM Authenticator for Kubernetes (aws-iam-authenticator). Multiple issues were identified in the authenticator that could have allowed exploitation, namely (1) a lax regular expression used to verify presigned URLs; (2) HTTP client redirect follow (due to using Golang HTTP client in its default configuration); (3) use of the Golang URL.Query function (which silently drops parameters that Go considers invalid, rather than raising an error and rejecting invalid tokens); and (4) no verification that the cluster uses Go versions newer than 1.12 (as older versions are vulnerable to request smuggling).
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://bugs.chromium.org/p/project-zero/issues/detail?id=2066
- https://github.com/kubernetes-sigs/aws-iam-authenticator/pull/341
Discovered by Felix Wilhelm (Google)View OCVDB entry ↗
terms-conditions-customer-dataCloudSeverity not specified
Disclosed 2020-07-08 · Published 2022-01-06
AWS AI services ToS allow sharing of customer data
aws
Use of the AI services on AWS allows customer data to be moved outside of the regions it is used in and potentially shared with third-parties. Note: This issue is outside the scope of this database's usual criteria for inclusion, but has been kept for historic reasons, as it was included in the original CSP Security Mistakes dataset.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Customers can opt out of this data usage by following the instructions included in the linked reference.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://twitter.com/benbridts/status/1280934515305824256
- https://summitroute.com/blog/2021/01/06/opting_out_of_aws_ai_data_usage/
Discovered by Ben BridtsView OCVDB entry ↗
ec2-console-xssCloudlow
Disclosed 2020-07-01
XSS on EC2 web console
awsEC2
Display of EC2 tags had XSS
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://embracethered.com/blog/posts/2020/aws-xss-cross-site-scripting-vulnerability/
Discovered by Johann Rehberger site ↗View OCVDB entry ↗
s3-crypto-sdkCloudlow
Disclosed 2020-07-01 · Published 2020-08-10
S3 Crypto SDK vulnerabilities
awsS3
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Update SDK
Related CVEs
CVE-2020-8912CVE-2020-8911
Exploitability windowNot specified
Detection methodsNot specified
References
Discovered by Sophie Schmieg (Google)View OCVDB entry ↗
cap-net-raw-metadata-mitmCloudmedium
Disclosed 2020-06-15
GKE and EKS CAP_NET_RAW metadata service MITM root privilege escalation
gcpawsGKEEKS
An attacker with access to a hostNetwork=true container with CAP_NET_RAW capability can listen to all the traffic going through the host and inject arbitrary traffic, allowing to tamper with most unencrypted traffic (HTTP, DNS, DHCP, ...), and disrupt encrypted traffic. In GKE the host queries the metadata service at http://169[.]254.169.254 to get information, including the authorized SSH keys. By manipulating the metadata service responses and injecting our own SSH key, it is possible to gain root privilege on the host.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://blog.champtar.fr/Metadata_MITM_root_EKS_GKE/
Discovered by Etienne ChampetierView OCVDB entry ↗
gcp-os-login-peCloudmedium
Disclosed 2020-06-04 · Published 2021-03-17
Privilege escalation in GCP OS Login
gcpOS Login
GCP provides an OS Login service for managing SSH access to compute instances using IAM roles. An attacker could abuse this feature via LXD, Docker (if available on the target system) and DHCP poisoning of the metadata server to escalate their privileges on a Google Compute Engine VM.
Remediation posture derived
Not specifiedDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Related CVEs
CVE-2020-8933CVE-2020-8907CVE-2020-8903
Exploitability windowuntil June 2020
Detection methodsNot specified
References
- https://gitlab.com/gitlab-com/gl-security/threatmanagement/redteam/redteam-public/red-team-tech-notes/-/tree/master/oslogin-privesc-june-2020
- https://initblog.com/2020/oslogin-privesc/
Discovered by Chris MoberlyView OCVDB entry ↗
rce-in-cloud-dmCloudhigh
Disclosed 2020-05-07 · Published 2020-05-21
RCE in Google Cloud Deployment Manager
gcpCloud Deployment Manager
An RCE in Google Cloud Deployment Manager could have allowed an attacker to make requests to internal Google services, authenticated as a privileged service account.
Remediation posture derived
Not specifiedDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowuntil 2020/05/20
Detection methodsNot specified
References
- https://www.ezequiel.tech/2020/05/rce-in-cloud-dm.html
Discovered by Ezequiel Pereira site ↗View OCVDB entry ↗
guardduty-cloudtrail-bypassCloudlow
Disclosed 2020-04-23
GuardDuty detection bypass via cloudtrail
awsGuardDuty
GuardDuty detected CloudTrail being outright disabled, but did not detect if an attacker with the necessary permissions filtered out all events from CloudTrail via PutEventSelectors, resulting in defenders having no logs to review. AWS fixed this issue by adding a GuardDuty detection that triggers if PutEventSelectors is used to disable all event types.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
As a safety measure, set up additional detections independent of GuardDuty.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://github.com/RhinoSecurityLabs/Cloud-Security-Research/tree/master/AWS/cloudtrail_guardduty_bypass
- https://twitter.com/0xdabbad00/status/1258909131605307393
Discovered by Spencer Gietzen (Rhino Security) site ↗View OCVDB entry ↗
gcp-cloudshell-cswshCloudlow
Disclosure date not specified · Published 2020-03-11
GCP Cloudshell Cross-Site WebSocket Hijacking (CSWSH)
gcpGCP Cloudshell
Google Cloudshell leveraged websockets without validating that the origin matched the current instance host. An attacker could therefore host a CSWSH attack on a Cloudshell instance they own, disabling authentication via access to the underlying VM. They could then start the OAuth process with a spoofed host header, using phishing to get the target Cloud Shell user into following a redirection link, completing the OAuth process and ending in successful CSWSH, which would allow the attacker to hijack the target user's requests.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
null
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://ψ.fun/i/yvpMj
- https://security.googleblog.com/2020/03/announcing-our-first-gcp-vrp-prize.html
Discovered by Psi site ↗View OCVDB entry ↗
ai-hub-jupyter-csrfCloudmedium
Disclosed 2020-03-10 · Published 2020-10-17
AI Hub Jupyter Notebook instance CSRF
gcpAI Hub Jupyter Notebook
AI Hub Jupyter Notebook server lacked a check of the Origin header that led to a CSRF vulnerability. An attacker could have read sensitive data and execute arbitrary actions in customer environments.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://blog.s1r1us.ninja/research/cookie-tossing-to-rce-on-google-cloud-jupyter-notebooks
Discovered by s1r1us site ↗View OCVDB entry ↗
google-cloud-shell-xss-rceCloudhigh
Disclosed 2020-02-06 · Published 2020-10-01
Google Cloud Shell XSS to RCE Vulnerability
gcpCloud Shell
A vulnerability in Google Cloud Shell allowed escalation from XSS to full instance takeover as root. The attack exploited an XSS in the markdown preview functionality to read sensitive files, obtain the instance's private key and hostname, and gain SSH access as root. The issue affected the Eclipse Theia-based editor used in Cloud Shell.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required. The vulnerability was fixed by Google.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2020/03/18
Detection methodsMonitor for unexpected SSH access to Cloud Shell instances, especially from external IP addresses. Review Cloud Shell access logs for anomalous activity.
References
- https://omespino.com/write-up-google-bug-bounty-xss-to-cloud-shell-instance-takeover-rce-as-root-5000-usd/
Discovered by Omar EspinoView OCVDB entry ↗
aws-data-postCloudSeverity not specified
Disclosed 2020-01-23
AWS uploaded sensitive data to public GitHub bucket
aws
An AWS employee pushed sensitive data to a public github bucket, including customer information and credentials. Note: This issue is outside the scope of this database's usual criteria for inclusion, but has been kept for historic reasons, as it was included in the original CSP Security Mistakes dataset.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
Discovered by an independent researcher (Upguard) site ↗View OCVDB entry ↗
cloudformation_cred_leakCloudhigh
Disclosed 2020-01-21 · Published 2020-09-22
CloudFormation resource provider credentials leak
awsCloudFormation
CloudFormation allows the use of Lambda-backed resource providers, wherein Lambda can be used to write custom provisioning logic to be executed during CloudFormation stack operations. The aforementioned Lambda functions were executed in an AWS-managed account (thus effectively allowing arbitrary code execution in that account), and were passed a set of credentials ("platformCredentials") for a role in this account that had several EventBridge permissions. These were sufficient for an attacker to create new rules in the AWS-managed account that leaked credentials belonging to other users of resource providers. For example, creating a rule that matched events with {"detail-type": ["AWS API Call via CloudTrail"]} exposed records of other tenants' API calls, which included copies of credentials for roles in other tenants' accounts.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://onecloudplease.com/blog/security-september-cataclysms-in-the-cloud-formations
Discovered by Aidan SteeleView OCVDB entry ↗
azure-cloud-shell-and-container-instance-lpeCloudhigh
Disclosed 2020-01-20 · Published 2021-02-15
Azure Cloud Shell and Container Instances breakout
azureCloud ShellContainer Instances
An attacker could gain root privileges on their Azure Cloud Shell container, escape from the container, and then gain root privileges on the underlying node, the root cause being an insecure kubelet port (10250), among other cluster misconfigurations. Once they could access the node filesystem, an attacker could extract kubelet API credentials which allowed listing all pods and nodes in the cluster, including those belonging to other tenants. Moreover, an attacker could bypass RBAC policies in the cluster by deploying a pod with the "NodeSelector" flag, and thereby escalate their privileges to root on other tenants' containers (the same issue affected Azure Container Instances).
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowuntil January 30th, 2020
Detection methodsNot specified
References
- https://hencohen10.medium.com/i-own-your-cloud-shell-taking-over-azure-cloud-shell-kubernetes-cluster-through-unsecured-558621519cf9
Discovered by Chen Cohen (eBay)View OCVDB entry ↗
google-domain-check-bypassCloudhigh
Disclosed 2020-01-04 · Published 2020-03-08
Google wide domain check bypass
gcpCloud ConsoleGMail APIActions ConsoleYouTube StudioGoogle Accounts
A vulnerability in Google's common JavaScript library allowed bypassing domain validation checks across multiple Google products. By using a backslash character in URLs, an attacker could make the regex parser and browser disagree on the authority (domain) portion of a URL, allowing injection of arbitrary domains that pass whitelisting checks.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2020/03/06
Detection methodsMonitor for unexpected URL parsing behaviors, especially URLs containing backslash characters between the authority and path components.
References
- https://feed.bugs.xdavidhu.me/bugs/0008
- https://bugs.xdavidhu.me/google/2020/03/08/the-unexpected-google-wide-domain-check-bypass/
Discovered by David Schütz site ↗View OCVDB entry ↗
gcp-stackdriver-ssrfCloudlow
Disclosure date not specified · Published 2019-12-19
GCP Stackdriver Debugger SSRF
gcpGCP Stackdriver Debugger
An SSRF bug in GCP's Stackdriver Debugger feature's code import could have been used to leak the authentication token of the user to an attacker-controlled server. Exploitation would require that the user had previously configured a specific code hosting service (such as GitHub), and could be tricked into clicking a malicious link.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://ngailong.wordpress.com/2019/12/19/google-vrp-ssrf-in-google-cloud-platform-stackdriver/
Discovered by Ron Chan site ↗View OCVDB entry ↗
gcp-cloushell-bugsCloudmedium
Disclosed 2019-12-16
GCP Cloudshell Vulnerabilities
gcpCloudshell
Wouter ter Maat discovered 9 vulnerabilities in GCP Cloudshell that could allow an attacker to access resources in another customer's environment.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
Discovered by Wouter ter Maat (Offensi) site ↗View OCVDB entry ↗
gcp-cloudshell-xss-csrfCloudmedium
Disclosure date not specified · Published 2019-12-15
GCP Cloudshell XSS and CSRF bugs
gcpGCP Cloudshell
GCP Cloudshell has been affected by various XSS and CSRF vulnerabilities stemming from different root causes related to authentication handling, markdown editing, file uploading and more. Explotiation of these vulnerabilities normally requires user interaction through social engineering (convincing a potential victim to click a malicious link).
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
null
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
Discovered by Obmi site ↗View OCVDB entry ↗
google-cloud-platform-vrp-prizeCloudmedium
Disclosure date not specified · Published 2019-11-29
Google Cloud Platform VRP Prize Writeup
gcpAI Hub
A vulnerability was discovered in Google Cloud Platform's AI Hub service, allowing unrestricted file uploads. This could potentially lead to bypassing Same-Origin Policy by uploading SWF files, enabling CSRF attacks across browsers, and exploiting CVE-2014-8453 on IE with Adobe Reader installed. The issue resulted in a $1337 bounty reward.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
CVE-2014-8453
Exploitability windowNot specified
Detection methodsMonitor for unusual file uploads or unexpected file types being served from the AI Hub service. Implement strict file type restrictions and content disposition headers for uploaded files.
References
- https://medium.com/@missoum1307/writeup-for-the-2019-google-cloud-platform-vrp-prize-4e104ef9f204
Discovered by Missoum SaidView OCVDB entry ↗
cve-2019-1372Cloudcritical
Disclosed 2019-10-08 · Published 2020-01-30
Azure App Service RCE
azureApp Service
A Vulnerability in App Service could allow an unprivileged function run by the user to execute code in the context of NT AUTHORITY\system, thereby escaping the sandbox. This vulnerability allowed cross-account access when using the Free/Shared tier.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Azure Cloud - None required, Azure Stack / Windows Azure Pack Web Sites V2 - Manual update
Related CVEs
CVE-2019-1372
Exploitability windowNot specified
Detection methodsNot specified
References
- https://research.checkpoint.com/2020/remote-cloud-execution-critical-vulnerabilities-in-azure-cloud-infrastructure-part-ii/
- https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2019-1372
Discovered by Ronen Shustin (Check Point) site ↗View OCVDB entry ↗
alb-http-smugglingCloudmedium
Disclosed 2019-10-04
ALB HTTP request smuggling
awsALB
ALBs found vulnerable to HTTP request smuggling (desync attack).
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Configure setting on your ALBs
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://twitter.com/arkadiyt/status/1180174359840862209
- https://docs.aws.amazon.com/elasticloadbalancing/latest/application/application-load-balancers.html
Discovered by James Kettle (Portswigger), Arkadiy Tetelman (Chime)View OCVDB entry ↗
lake_admin_overrideCloudhigh
Disclosed 2019-08-15
Lake Formation data lake admin override
awsLake Formation
Shortly after Lake Formation was made generally available, a bug was discovered that gave anyone the ability to view and override data lake admins for any account (an attacker would have only needed to know the target account number in advance). The root cause was in the Catalog ID, which references the Glue metadata store that Lake Formation uses to store its configuration - none of the methods that used this field actually checked for permissions on the account it was accessing, only the source account. Moreover, CloudTrail was only writing the log to the source account, so anyone auditing the destination account would not have been able to observe any suspicious activity. Following disclosure, AWS fixed the bug.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://twitter.com/iann0036/status/1161871038336028672
- https://pastebin.com/jfPtSp3a
Discovered by Ian MckayView OCVDB entry ↗
aws-imds-credential-exfiltrationCloudmedium
Disclosed 2019-08-04
AWS IAM role credential exfiltration via EC2 Instance Metadata Service (IMDSv1)
awsEC2
AWS offers a metadata service accessible to most EC2 Instances via a simple GET request to 169.254.169.254. If an instance has an SSRF vulnerability, attackers can access the metadata service & exfiltrate the credentials of an attached IAM role to gain privileged access to the relevant AWS environment.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Enforce the use of IMDSv2 on the instance. This will require use of a POST request to generate an access token, which mitigates against most SSRF vulnerabilities
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowongoing
Detection methodsNot specified
References
View OCVDB entry ↗
gcp-iam-pe-multiple-servicesCloudhigh
Disclosed 2019-06-03 · Published 2020-11-22
IAM privilege escalation in multiple GCP services
gcpComposerDataflowDataprocDataprepData Fusion
Composer, Dataflow, Dataproc, Dataprep and Data Fusion all used the Compute Engine default service account by default and relied on product-level IAM permissions without requiring the iam.serviceAccount.actAs permission, meaning that users of these services could elevate their privileges. Following disclosure, GCP changed these services to require this permission.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowOngoing, partially fixed on June 2020
Detection methodsNot specified
References
- https://security.love/blog/gcp/2020/11/22/lateral-movement-and-privesc-in-GCP.html
Discovered by Allison Donovan, Dylan Ayrey site ↗View OCVDB entry ↗
vpc-hosted-zones-unauditableCloudlow
Disclosed 2019-05-13 · Published 2019-05-24
VPC Hosted Zones unauditable
aws
For 6 years, it was not possible to see what hosted zones an attacker may have created in an account. This issue could be viewed as a business decision that adding the ability to viewing this data was not worthwhile, but the delay is significant and would allow someone that had compromised an environment to maintain a backdoor.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Audit your VPC hosted zones
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://twitter.com/__steele/status/1273748905826455552
- https://blog.ryanjarv.sh/2019/05/24/backdooring-route53-with-cross-account-dns.html
Discovered by Ryan GerstenkornView OCVDB entry ↗
gcp-speech-to-text-info-disclosureCloudmedium
Disclosed 2019-04-09 · Published 2020-01-12
GCP Speech to Text Information Disclosure
gcpGCP Speech-to-Text
GCP's Speech-to-Text "operations/list" and "operations/get" APIs would return data that did not belong to the caller when no parameters were provided. It is unclear whether this was cross-customer data disclosure, or potentially test or internal data.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://www.dcine.com/2020/01/12/information-disclosure-vulnerability-in-the-google-cloud-speech-to-text-api/
Discovered by Dan Maas site ↗View OCVDB entry ↗
aws-codestar-privilege-escalationCloudhigh
Disclosed 2019-03-19 · Published 2019-06-18
IAM privilege escalation via undocumented CodeStar API
awsCodestar
The AWS CodeStar service had an undocumented API (codestar:CreateProjectFromTemplate) that allowed users with broadly-scoped CodeStar permissions to create a CodeStar project. As part of the creation process, AWS would create a new CodeStarWorker IAM policy & attach it to the user making the call. This policy granted full access to over 50 AWS services, including iam:AttachRolePolicy, iam:AttachUserPolicy and iam:PutRolePolicy permissions, which would allow the user to escalate to full administrator access. Following disclosure, AWS removed the majority of access granted by the CodeStarWorker policy, but this is still a viable escalation path if there are other misconfigurations in the environment.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
If not using the CodeStar service, ensure that the “aws-codestar-service-role” is removed from all your accounts. Apply principle of least privilege to all CodeStar-related resources to ensure the codestar:CreateProjectFromTemplate permission is only granted when absolutely necessary. Implement monitoring on any users with access to the codestar:CreateProject and iam:PassRole actions to detect potential escalation attempts.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowOngoing
Detection methodsNot specified
References
- https://rhinosecuritylabs.com/aws/escalating-aws-iam-privileges-undocumented-codestar-api/
Discovered by Spencer Gietzen (Rhino Security Labs) site ↗View OCVDB entry ↗
azure-cloudshell-terminal-escapeCloudmedium
Disclosed 2019-01-09
Azure Cloud Shell terminal escape
azureCloudshell
If attacker controlled data is viewed in Cloudshell it could have led to code execution. This exact same issue was later discovered in AWS as well.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://twitter.com/_fel1x/status/1083085715565621250
Discovered by Felix Wilhelm (Google)View OCVDB entry ↗
gcp-organization-rename-impersonationCloudmedium
Disclosed 2018-11-29 · Published 2019-01-20
Impersonate GCP Organization Through the Organizations Update Method
gcpGCP Organizations
A GCP Organizations name could be changed through the (deprecated) organizations.update method in the Resource Manager, even though the documentation said the "displayName" was read-only. With this, I could have my own organization and name it as another one and confuse users: - Rename an organization "<IMPORTANT-COMPANY>.com" - Share it with "domain:<IMPORTANT-COMPANY>.com" (Effectively sharing it with every Google user with a @<IMPORTANT-COMPANY>.com account) - Profit from unsuspecting users creating resources in my organization, specially billing accounts or building projects that manage sensible information.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://www.ezequiel.tech/2019/01/75k-google-cloud-platform-organization.html
Discovered by Ezequiel Pereira site ↗View OCVDB entry ↗
resource-policy-confused-deputyCloudlow
Disclosed 2018-11-28
Resource policy confused deputy issue with services
aws
Resource policies lacked a way of restricting service access to only your own account, allowing an attacker to leverage a service to potentially access your resources. Originally discovered by Dan Peebles and presented at re:Invent in 2018, this issue did not gain enough attention to be fixed until Shir Tamari and Ami Luttwak from Wiz presented it at Black Hat 2021.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Update existing vulnerable IAM policies by adding scoping condition.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowuntil February 2021
Detection methodsNot specified
References
Discovered by Dan Peebles (Bridgewater) site ↗View OCVDB entry ↗
cve-2018-15869Cloudmedium
Disclosed 2018-08-13
Launching EC2s did not require specifying AMI owner
awsEC2
Attackers had put malicious AMIs in the marketplace to abuse the CLI''s way of selecting what AMI to use. Although the concept of planting malicious AMIs had existed for a while (ex. in the 2009 presentation "Clobbering the clouds" by Nicholas Arvanitis, Marco Slaviero, and Haroon Meer) it had not been used specifically to target this issue with the CLI.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Update CLI and other tools that create EC2s
Related CVEs
CVE-2018-15869
Exploitability windowNot specified
Detection methodsNot specified
References
- https://github.com/hashicorp/packer/issues/6584
Discovered by Megan MarshView OCVDB entry ↗
azure-subdomain-takeoverCloudlow
Disclosed 2018-08-10
Subdomain takeover via Azure Traffic Manager
azureTraffic Manager
Patrick Hudak demonstrated possible subdomain takeover using the Traffic Manager in Azure.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Review your DNS zones and identify CNAME records that are dangling or have been taken over. For further recommendations, review Microsoft's article on subdomain takeovers (linked in references).
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowongoing
Detection methodsNot specified
References
- https://0xpatrik.com/subdomain-takeover-starbucks-ii/
- https://docs.microsoft.com/en-us/azure/security/fundamentals/subdomain-takeover
Discovered by Patrick Hudak site ↗View OCVDB entry ↗
google-app-engine-rceCloudhigh
Disclosed 2018-02-25 · Published 2019-08-31
Google App Engine RCE Worth $36k
gcpApp Engine
Researcher discovered access to non-production Google App Engine environments and internal APIs. This allowed configuring internal settings like Service Account IDs and quotas. Google considered it RCE due to their infrastructure. Access was blocked and a $36,337 reward issued.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowUntil 2018/03/13
Detection methodsMonitor for unexpected access attempts to non-production App Engine environments. Review App Engine configuration changes, especially around Service Accounts and quotas.
References
- https://www.ezequiel.tech/p/36k-google-app-engine-rce.html
Discovered by Ezequiel PereiraView OCVDB entry ↗
aws-elasticsearch-index-name-leakageCloudlow
Disclosed 2018-01-30 · Published 2018-05-15
AWS ElasticSearch Index Name Leakage
awsAWS ElasticSearch
Even for the AWS-managed ElasticSearch clusters that had not been made public, their index names could be learned.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://duo.com/blog/beyond-s3-exposed-resources-on-aws
Discovered by Scott Piper (Duo Security)View OCVDB entry ↗
iam-policies-bypass-overprivilegedCloudmedium
Disclosed 2017-11-07
Bypassable and overly-privileged IAM policies
aws
AWS has previously provided managed policies or guidance in documentation for policies with mistakes that allow them to be bypassed. Additionally, some policies are over-privileged. Date of disclosure is for the first issue of this type, while references provide other examples by various individuals.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Review the policies provided by AWS
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
Discovered by Multiple findingsView OCVDB entry ↗
aws-java-sdk-xxeCloudlow
Disclosure date not specified · Published 2017-10-10
AWS Java SDK XXE injection
awsJava SDK
The AWS Java SDK was vulnerable to XML external entity (XXE) injection related to XML parsers.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://github.com/aws/aws-sdk-java/commit/080a0037395f8b1e8e81b59c9d2c3a3d7624c8ac
- https://twitter.com/alexbrasetvik/status/1293088161363525633
Discovered by Alex BrasetvikView OCVDB entry ↗
admin-azure-rh-update-infrastructureCloudlow
Disclosed 2016-11-26
Public admin access to Azure's Red Hat Update Infrastructure
azure
Full administrative access to the Azure Red Hat Enterprise Linux Appliance REST API was publicly exposed. It allowed malicious actors uploading packages that would be acquired by client virtual machines on their next yum update. The vulnerable infrastructure supplies all the packages for all Red Hat Enterprise Linux instances booted from the Azure marketplace.
Remediation posture derived
Fixed by the cloud providerDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- https://ianduffy.ie/2016/11/26/azure-bug-bounty-pwning-red-hat-enterprise-linux/
Discovered by Ian Duffy site ↗View OCVDB entry ↗
assumerole-confused-deputyCloudmedium
Disclosed 2016-11-16
3rd party vendor confused deputy via AssumeRole
aws
3rd party vendors can (and sometimes do) incorrectly implement sts:ExternalId in their AWS role trust policies, leading to confused deputy issues. These misconfigurations could allow customers to access other customers' data. Although vendors are responsible for ensuring their own configurations are correct, AWS could theoretically add mitigations to prevent and detect this issue.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Audit your vendor roles.
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowongoing
Detection methodsNot specified
References
- https://www.youtube.com/watch?v=8ZXRw4Ry3mQ
- https://www.praetorian.com/blog/aws-iam-assume-role-vulnerabilities/
Discovered by Daniel Grzelak (Atlassian) site ↗View OCVDB entry ↗
ami-recoverable-filesCloudlow
Disclosed 2011-06-04
AWS published official AMIs with recoverable deleted files
aws
Researchers, while investigating the security posture of Public AMIs, were able to undelete files from an official image that was published by Amazon AWS.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
Follow [best practices](https://aws.amazon.com/articles/how-to-share-and-use-public-amis-in-a-secure-manner/) when sharing Public AMIs
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowNot specified
Detection methodsNot specified
References
- http://seclab.nu/static/publications/sac2012ec2.pdf
- https://aws.amazon.com/security/security-bulletins/reminder-about-safely-sharing-and-using-public-amis/
Discovered by Marco Balduzzi, Jonas Zaddach, Davide Balzarotti, Engin Kirda, Sergio LoureiroView OCVDB entry ↗
aws-sigv1-insecureCloudmedium
Disclosure date not specified · Published 2008-12-18
Signature version 1 (SigV1) is insecure
aws
When making authenticated API requests to AWS, the requests must be signed with your AWS access key. The initial signing algorithm, SigV1, was vulnerable to collisions. A person-in-the-middle attack would be able to modify signed requests via specially constructed collisions.
Remediation posture derived
Customer remediation requiredDerived from the remediation guidance. OCVDB does not track a formal open or closed state.
None required, SigV1 is deprecated at this point
Related CVEs
No CVE assigned. Tracked as a cloud vulnerability (OCVDB).
Exploitability windowuntil December 18th, 2008
Detection methodsNot specified
References
- http://www.daemonology.net/blog/2008-12-18-AWS-signature-version-1-is-insecure.html
Discovered by Colin PercivalView OCVDB entry ↗

About this data

Entries come from the Open Cloud Vulnerability Database (OCVDB), a community catalog of cloud provider vulnerabilities maintained by Wiz and contributors. They are a distinct entity from the Common Vulnerabilities and Exposures (CVE) table: most cloud vulnerabilities are fixed by the provider platform-side and never receive a CVE identifier, so this tracker keys them on the entry slug and never mixes them into the vulnerabilities table. When an entry names CVEs, each one this tracker follows links into the vulnerabilities table; when it names none, the entry reads "No CVE assigned". OCVDB carries no authoritative open or closed status, so this page does not invent one: the remediation posture is derived from the entry's own remediation guidance and is clearly labelled derived. Severity, the exploitability window, detection methods, and dates are shown only when the entry provides them, and read "Not specified" otherwise, never a fabricated value or a zero.

Cloud vulnerability data is theOpen Cloud Vulnerability Database (OCVDB), licensedCC BY 4.0, maintained by Wiz and OCVDB contributors. Individual researcher credit is shown on each entry.

Entra ID actor token validation bug allowing cross-tenant global admin

Dataform cross-tenant path traversal

AWS ECS Agent Information Disclosure Vulnerability

FreeRTOS and coreSNTP Security Advisories

Azure AZNFS-mount Utility Root Privilege Escalation

AWS Default Roles Can Lead to Service Takeover

Google Cloud ConfusedComposer Privilege Escalation Vulnerability

AWS CDK CLI Issue with Custom Credential Plugins

Issue with AWS Temporary Elevated Access Management

Abusing AWS Serverless Image Handler Configuration Weakness

Path Traversal in AWS SSM Agent Plugin ID Validation

Remote Prompt Injection in GitLab Duo Leaks Source Code

Entra ID Allows Users to Update Principal Names

AWS Sign-in IAM User Login Flow Username Enumeration

CodeQLEAKED - CodeQL Supply Chain Attack via Exposed Secret

Issue with Amazon WorkSpaces and AppStream 2.0 Clients

Hijacking Azure Machine Learning Notebooks

Azure API Connections Expose Backend Secrets

Silent Reaper (Azure LogicApp Secrets Control Plane Exfiltration)

Vault Recon (Azure KeyVault Secrets Metadata Control Plane Exfiltration)

Dirty DAG - Azure Apache Airflow Integration Vulnerabilities

AWS Security Tool Introduces Privilege Escalation Risk

ImageRunner: Privilege Escalation Vulnerability in GCP Cloud Run

ModeLeak: LLM Model Exfiltration Vulnerability in Vertex AI

Issue with data.all Framework Multiple CVEs

Repo swatting attack deletes/blocks GitHub and GitLab accounts

Code Execution in Azure API Management Developer Portal

CloudImposer

Confused Deputy Vulnerability in Amazon DataZone

Entra ID Bug Creates Immutable Users

WireServing Up Credentials in Azure Kubernetes Services

Google Cloud Data Fusion GitHub Actions Vulnerabilities

Burning Data with Malicious Firewall Rules in Azure SQL

CloudShell Vulnerability Grants Unintended AWS Access

CloudWatch Dashboard Sharing Exposes EC2 Tags

Security Flaw in AWS Transit Gateway Peering Attachments

GCP Cloud Functions Privilege Escalation Vulnerability

Bedrock API Logging Issue

AWS Client VPN buffer overflow

AWS CDK Bucket Squatting Risk

Issue with AWS Deployment Framework

Issue with Amazon EC2 VM Import Export Service

Data exfil via VPC endpoint denials in CloudTrail

Subdomain Takeover Vulnerability in GitLab Pages

AWS Direct Connect route injection issue

Internal Azure Container Registry writable via exposed secret

Lethal Injection

Escalating from Reader to Contributor in Azure API Management

GraphNinja

Document AI data exfiltration

FlowFixation

GitHub Copilot Chat Vulnerable to Data Exfiltration

Bucket Monopoly Attack on AWS Services

GCP HMAC Keys do not log creation, deletion or usage

GCP HMAC Keys are not discoverable or revokable other than for self

Unauthorized Access to AWS Account Findings in Microsoft Defender for Cloud

Azure HDInsight privilege escalation and DoS vulnerabilities

Synapse Analytics privilege escalation via intelligent caching

Abusing Service Tags to Bypass Azure Firewall Rules

Google Cloud GKE Unsecure Sys:All Binding

Flaw in Bedrock's Foundation Model Access Control

IAM Policy Flaw Allowed Unauthorized Access to Bedrock Models

Privilege Elevation Vulnerability in Entra ID

AWS Amplify IAM role publicly assumable exposure

Azure Site Recovery privilege escalation

Microsoft Healthcare Chatbot Vulnerabilities

Data Exfiltration Through CloudTrail

Critical GitLab Account Takeover Vulnerability

Amazon Q for Business Data Exfiltration

AWS IAM Identity Center Expiry

Sketchy Cheat Sheet

Azure tenant takeover via Microsoft application

Azure Automation Service Used for Cryptocurrency Mining

ApatchMe

Control plane bypass in Azure OpenAI

Finding SSRFs in Azure DevOps

Amazon WorkSpaces Windows client credential logging

Azure AI Playground data exfiltration

Amazon Cognito Rate Limit Bypass Vulnerability

Chronicle cross-customer bucket access