Summary
Dataflow worker nodes ran an unauthenticated Java Management Extensions (JMX) service that under
certain circumstances would be exposed to the Internet, thus allowing unauthenticated remote code
execution (RCE) as root in an unprivileged container. The impact of the vulnerability depended on
which service account qA assigned to Dataflow worker nodes (by default, that would be the Google
Compute Engine default service account, which has the project-wide Editor role assigned).
Affected Services
Dataflow
Remediation
None required
Tracked CVEs
No tracked CVEs
References
https://mbrancato.github.io/2021/12/28/rce-dataflow.htmlhttps://portswigger.net/daily-swig/google-showers-top-cloud-security-researchers-with-kudos-and-cash
Contributed by https://github.com/korniko98
Entry Status
Finalized
Disclosure Date
Fri, Mar 5th, 2021
Exploitablity Period
-
Known ITW Exploitation
-
Detection Methods
-
Piercing Index Rating
-
Discovered by
Mike Brancato
