Summary
Cloud Audit Logs do not capture actions mediated through the cloud console private API
service (cloudconsole-pa). Consequently, there is no logging of HMAC key creation or deletion
linked to user accounts. This absence of logs hampers defenders' ability to alert or monitor
the creation of HMAC keys for user accounts, posing a persistence risk, or their deletion,
presenting a denial of service risk.
Affected Services
Google Cloud Storage XML API, Cloud Console Private API Service
Remediation
None possible
Tracked CVEs
No tracked CVEs
References
Contributed by https://github.com/KatTraxler
Entry Status
Finalized
Disclosure Date
Wed, Feb 7th, 2024
Exploitablity Period
Ongoing
Known ITW Exploitation
-
Detection Methods
-
Piercing Index Rating
-
Discovered by
Kat Traxler, Vectra AI
