A sequence of two essential flaws has been disclosed in Alibaba Cloud’s ApsaraDB RDS for PostgreSQL and AnalyticDB for PostgreSQL that may very well be exploited to breach tenant isolation protections and entry delicate information belonging to different clients.
“The vulnerabilities probably allowed unauthorized entry to Alibaba Cloud clients’ PostgreSQL databases and the flexibility to carry out a provide chain assault on each Alibaba database companies, resulting in an RCE on Alibaba database companies,” cloud safety agency Wiz said in a brand new report shared with The Hacker Information.
The issues, dubbed BrokenSesame, have been reported to Alibaba Cloud in December 2022, following mitigations have been deployed by the corporate on April 12, 2023. There is no such thing as a proof to recommend that the weaknesses have been exploited within the wild.
In a nutshell, the vulnerabilities – a privilege escalation flaw in AnalyticDB and a distant code execution bug in ApsaraDB RDS – made it attainable to raise privileges to root inside the container, escape to the underlying Kubernetes node, and in the end get hold of unauthorized entry to the API server.
Armed with this functionality, an attacker may retrieve credentials related to the container registry from the API server and push a malicious picture to achieve management of buyer databases belonging to different tenants on the shared node.
“The credentials used to tug photographs weren’t scoped appropriately and allowed push permissions, laying the muse for a supply-chain assault,” Wiz researchers Ronen Shustin and Shir Tamari mentioned.
This isn’t the primary time PostgreSQL vulnerabilities have been recognized in cloud companies. Final yr, Wiz uncovered comparable points in Azure Database for PostgreSQL Versatile Server (ExtraReplica) and IBM Cloud Databases for PostgreSQL (Hell’s Keychain).
Defend with Deception: Advancing Zero Belief Safety
Uncover how Deception can detect superior threats, cease lateral motion, and improve your Zero Belief technique. Be a part of our insightful webinar!
The findings come as Palo Alto Networks Unit 42, in its Cloud Threat Report, revealed that “menace actors have turn out to be adept at exploiting widespread, on a regular basis points within the cloud,” together with misconfigurations, weak credentials, lack of authentication, unpatched vulnerabilities and malicious open supply software program (OSS) packages.
“76% of organizations do not implement MFA [multi-factor authentication] for console customers, whereas 58% of organizations do not implement MFA for root/admin customers,” the cybersecurity agency mentioned.
