Summary
Google Cloudshell leveraged websockets without validating that the origin matched the current instance host.
An attacker could therefore host a CSWSH attack on a Cloudshell instance they own, disabling authentication via
access to the underlying VM. They could then start the OAuth process with a spoofed host header, using
phishing to get the target Cloud Shell user into following a redirection link, completing the OAuth process
and ending in successful CSWSH, which would allow the attacker to hijack the target user's requests.
Affected Services
GCP Cloudshell
Remediation
null
Tracked CVEs
No tracked CVEs
References
https://ψ.fun/i/yvpMjhttps://security.googleblog.com/2020/03/announcing-our-first-gcp-vrp-prize.html
Contributed by https://github.com/ramimac
Entry Status
Finalized
Disclosure Date
-
Exploitablity Period
-
Known ITW Exploitation
-
Detection Methods
-
Piercing Index Rating
-
Discovered by
Psi
