Reported by Colin Domoney Must Read Article1-Aug-25-2023-01-31-48-4868-PM (APIsecurity.io) Great article
This week, we have news of the so-called GhostToken vulnerability, which could allow attackers to target Google Cloud users via the application marketplace. According to the researchers at Astrix who discovered the vulnerability, it could have allowed attackers to access the target account’s Google Drive, Calendar, Photos, Google Docs, Google Maps, and other Google Cloud Platform services. The researchers reported their findings to Google in June 2022, Google accepted them in August 2022, and in April 2023, they released a global patch to address the issue. Researchers also recommended that Google Cloud users regularly verify the application installed on their instance using the application management page on the Google Cloud portal.
The root cause of the vulnerability relates to the manner in which Google Cloud manages the lifecycle of an application and, specifically, how the application’s associated OAuth2 tokens are managed. The Google Cloud provides a 30-day grace period from the time an application is scheduled for deletion until the time it is permanently deleted. This grace period is to allow administrators an opportunity to recover resources deleted in error. While in the pending deletion state, the application (and its associated resources such as OAuth2 tokens) are invisible to platform users. The researchers at Astrix discovered that if an application’s pending deletion was canceled within the 30-day window, then the application and all its associated resources would be restored. They tested this with an OAuth2 token and discovered that this token still provided access to its original resources.
They describe how this delete/pending deletion/cancel deletion loop can be used to effectively hide a rogue application from the application management page of a user’s Google Cloud portal, using the following attack flow:
Article (https://apisecurity.io/issue-227-ghosttoken-on-google-cloud-gartner-on-zero-trust-api-authentication/?_hsmi=271737197&_hsenc=p2ANqtz-9IfgoA5y7vMToerm-_dYKoPrJLUPxYuxFbM8t5n55gQjVb4nUIY4VGKXjHA1ZcwroZuWFiAt3S0OtpnQcQ2GvjR9SmAA)
Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Axcient
“Where Service and Technical Skills Count”
