A vulnerability called ‘AttatchMe’, discovered by a Wiz engineer could have allowed the attackers to access and steal the OCI storage volumes of any user without their permission.
During an Oracle cloud infrastructure examination in June, Wiz engineers disclosed a cloud isolation security flaw in Oracle Cloud Infrastructure. They found that connecting a disk to a VM in another account can be done without any permissions, which immediately made them realize it could become a path for cyberattacks for threat actors.
Elad Gabay, the security researcher at Wiz made a public statement regarding the vulnerability on September 20. He mentioned the possible severe outcomes of the exploitation of the vulnerability saying this could have led to “severe sensitive data leakage” for all OCI customers and could even be exploited to gain code execution remotely.
To exploit this vulnerability, attackers need unique identifiers and the oracle cloud infrastructure’s environment ID (OCID) of the victim, which can be obtained either through searching on the web or through low-privileged user permission to get the volume OCID from the victim’s environment.
The vulnerability ‘AttachMe’ is a critical cloud isolation vulnerability, which affects a specific cloud service. The vulnerability affects user data/files by allowing malicious actors to execute severe threats including removing sensitive data from your volume, searching for cleartext secrets to move toward the victim’s environment, and making the volume difficult to access, in addition to partitioning the disk that contains the operating system folder.
Read the full article here
