high
Chronicle cross-customer bucket access
Published Tue, Sep 19th, 2023
Platforms
Summary
Customers can configure Chronicle to ingest data from customer-owned Cloud Storage buckets using an ingestion feed. Chronicle previously used a shared service account for all customers for granting permission to the bucket. Therefore, one customer's Chronicle instance could be configured to ingest data from another customer's Cloud Storage bucket. However, this required knowledge of the bucket URI.
Affected Services
Chronicle
Remediation
null
Tracked CVEs
No tracked CVEs
References
Contributed by https://github.com/ramimac
Entry Status
Finalized
Disclosure Date
Tue, Sep 19th, 2023
Exploitability Period
until Sept 19, 2023
Known ITW Exploitation
-
Detection Methods
None
Piercing Index Rating
-
Discovered by
DoggoZW
