Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Filling up the DagBag: Privilege Escalation in Google Cloud Composer

netspi.com | vulnerability | #bug-bounty | #cloud | #cloud-security | #privilege-escalation | #gcp | #cloud-composer | #apache-airflow | #service-account

Summary

Write access to a Cloud Composer storage bucket lets attackers upload a malicious DAG, gain command execution, and hijack its service account, which defaults to project Editor privileges.
Published
Collected

original ↗

Related coverage

vulnerability · projectdiscovery.io
Securing the distributed perimeter: How Elastic scaled proactive detection with ProjectDiscovery Cloud
Elastic ran ~50,000 servers across AWS, Azure, and GCP and adopted ProjectDiscovery Cloud, scanning 14,500 external assets in under five minutes after outgrowing legacy scanners like BitSight.
vulnerability · projectdiscovery.io
How ConnectWise streamlined vulnerability detection with ProjectDiscovery
ConnectWise moved vulnerability scanning for 20,000+ AWS instances from Tenable Cloud to ProjectDiscovery, cutting scan time for 10,000 assets from two days to 15 minutes and retiring custom scripts.
blog · netspi.com
Utilizing Azure Services for Red Team Engagements
Explores hosting red team phishing pages and payloads on Azure services under Microsoft's trusted domains, using their good reputation to slip past web filters as domain fronting fades.
blog · netspi.com
2013 Cyber Threat Forecast Released
Reviews the Georgia Tech 2013 cyber threat forecast: cloud botnets, mobile browser and wallet flaws, malware obfuscation, counterfeit hardware in the supply chain, and healthcare data risks.
blog · netspi.com
Pentesting the Cloud
After a dull conference, the author concludes cloud pentesting is fundamentally the same as traditional testing: virtualized or shared, the underlying technology and security controls hardly change.
blog · netspi.com
EMR Security in the Cloud
I recently had the opportunity to review an article by Michael Koploy of Software Advice titled "HHS Data Tells the True Story of HIPAA Violations in the Cloud".
back