Summary
Customers can configure Chronicle to ingest data from customer-owned
Cloud Storage buckets using an ingestion feed. Chronicle previously used a shared
service account for all customers for granting permission to the bucket.
Therefore, one customer's Chronicle instance could be configured to ingest data
from another customer's Cloud Storage bucket. However, this required knowledge
of the bucket URI.
Affected Services
Chronicle
Remediation
null
Tracked CVEs
No tracked CVEs
References
https://cloud.google.com/support/bulletins#gcp-2023-028https://x.com/DoggoZW/status/1706290389974495650
Contributed by https://github.com/ramimac
Disclosure Date
Tue, Sep 19th, 2023
Exploitablity Period
until Sept 19, 2023
Known ITW Exploitation
-
Detection Methods
-
Piercing Index Rating
-
Discovered by
DoggoZW
