Researchers Reveal Critical Vulnerability in Oracle Cloud Infrastructure

by
Oracle Cloud Infrastructure (OCI) Vulnerability

Researchers have revealed a new severe Oracle Cloud Infrastructure (OCI) vulnerability that could be exploited by users to access virtual disks from other Oracle customers.

“Each virtual disk in Oracle’s cloud has a unique identifier called an OCID,” said Shir Tamari, research manager at Wiz. said in a series of tweets. “This ID is not considered secret and organizations do not treat it as such.”

“Given the OCID of a victim’s disk that is not currently attached to an active server or configured as shareable, an attacker could ‘attach’ to it and obtain a read/write on it,” Tamari added.

cyber security

The cloud security firm, which dubbed the tenant isolation vulnerability “tie me up“said Oracle fixed the problem within 24 hours of responsible disclosure on June 9, 2022.

Oracle Cloud Infrastructure
Accessing a volume using the CLI without sufficient permissions

At its core, the vulnerability is rooted in the fact that a disk could be attached to a compute instance in another account via the Oracle Cloud Identifier (OCID) without any explicit permission.

This meant that an attacker in possession of the OCID could have taken advantage of AttachMe to gain access to any storage volume, leading to data exposure, exfiltration or, worse, modification of boot volumes for get code execution.

Besides knowing the OCID of the target volume, another prerequisite for a successful attack is that the adversary instance must be in the same availability domain (AD) as the target.

cyber security

“Insufficient validation of user permissions is a common class of bugs among cloud service providers,” said Elad Gabay, researcher at Wiz. “The best way to identify these issues is to perform rigorous code reviews and comprehensive testing for each sensitive API in development.”

The results come almost five months after Microsoft address a pair of issues with Azure Database for PostgreSQL Flexible Server that can lead to unauthorized cross-account database access in a region.

You may also like

Leave a Comment

About Us

Times Global Will keep you updated To the Latest News Around The Globe..

Feature Posts

Newsletter

Subscribe my Newsletter for new blog posts, tips & new photos. Let's stay updated!

Subscribe To our Newsletter

Join our subscribers list and get Latest News directly to your inbox.