BOSTON, MASS. and TEL AVIV, ISRAEL, November 28, 2023 – A extreme design flaw in Google Workspace’s domain-wide delegation characteristic found by menace searching specialists from Hunters’ Staff Axon, can enable attackers to misuse present delegations, enabling privilege escalation and unauthorized entry to Workspace APIs with out Tremendous Admin privileges.
This sort of hacking might result in the theft of emails from Gmail, information from Google Drive, or different unlawful actions within the Google Workspace APIs for all customers within the goal area. Hunters informed Google about this in a accountable approach and labored intently with them earlier than placing out this research.
Area-wide delegation lets Google Cloud Platform (GCP) identification objects and Google Workspace apps delegate all of their duties. For instance, it lets GCP accounts do issues on behalf of different Workspace customers in Google SaaS apps like Gmail, Google Calendar, Google Drive, and extra.
The design flaw, which the Hunters staff has named “DeleFriend,” lets attackers change present delegations in GCP and Google Workspace with out having the Tremendous Admin function on Workspace, which is required to make new delegates.
As a substitute, with much less entry to a goal GCP challenge, they’ll make a variety of JSON net tokens (JWTs) with totally different OAuth scopes. The purpose is to search out the correct mix of personal key pairs and licensed OAuth scopes that present the service account has domain-wide delegation turned on.
The primary purpose for that is that the area switch setup relies on the service account useful resource identifier (OAuth ID), not the non-public keys which can be linked to the service account identification object.
Moreover, there have been no limits placed on the fuzzing of JWT pairs on the API stage. Which means that there are a variety of methods to search out and take over present delegations.
This flaw poses a particular threat as a consequence of potential influence described above and is amplified by the next:
- Lengthy Life: By default, GCP Service account keys are created with out an expiry date. This characteristic makes them preferrred for establishing backdoors and guaranteeing long-term persistence.
- Straightforward to cover: The creation of latest service account keys for present IAMs or, alternatively, the setting of a delegation rule throughout the API authorization web page is straightforward to hide. It’s because these pages usually host a big selection of professional entries, which aren’t examined totally sufficient.
- Consciousness: IT and Safety departments might not all the time be cognizant of the domain-wide delegation characteristic. They may particularly be unaware of its potential for malicious abuse.
- Laborious to detect: Since delegated API calls are created on behalf of the goal identification, the API calls will probably be logged with the sufferer particulars within the corresponding GWS audit logs. This makes it difficult to establish such actions.
“The potential penalties of malicious actors misusing domain-wide delegation are extreme. As a substitute of affecting only a single identification, as with particular person OAuth consent, exploiting DWD with present delegation can influence each identification throughout the Workspace area,” says Yonatan Khanashvili of Hunters’ Staff Axon.
The vary of doable actions varies based mostly on the OAuth scopes of the delegation. As an example, electronic mail theft from Gmail, information exfiltration from the drive, or monitor conferences from Google Calendar.
With a view to execute the assault methodology, a specific GCP permission is required on the goal Service Accounts. Nonetheless, Hunters noticed that such permission isn’t an unusual apply in organizations making this assault approach extremely prevalent in organizations that don’t preserve a safety posture of their GCP sources. “By adhering to greatest practices, and managing permissions and sources neatly, organizations can dramatically decrease the influence of the assault methodology” Khanashvili continued.
Hunters has created a proof-of-concept instrument (full particulars are included within the full analysis) to help organizations in detecting DWD misconfigurations, growing consciousness, and lowering DeleFriend’s exploitation dangers. Utilizing this instrument, pink groups, pen testers, and safety researchers can simulate assaults and find susceptible assault paths of GCP IAM customers to present delegations of their GCP Tasks to guage (after which enhance) the safety threat and posture of their Workspace and GCP environments.
Hunters’ Staff Axon has additionally compiled complete analysis that lays out precisely how the vulnerability works in addition to suggestions for thorough menace searching, detection strategies, and greatest practices for countering domain-wide delegation assaults.
Hunters responsibly reported DeleFriend to Google as a part of Google’s “Bug Hunters” program in August, and are collaborating intently with Google’s safety and product groups to discover acceptable mitigation methods. At present, Google has but to resolve the design flaw.
Learn the total analysis right here, and observe Hunters’ Staff Axon on Twitter.
About Hunters
Hunters delivers a Safety Operations Middle (SOC) Platform that reduces threat, complexity, and price for safety groups. A SIEM different, Hunters SOC Platform supplies information ingestion, built-in and all the time up-to-date menace detection, and automatic correlation and investigation capabilities, minimizing the time to know and reply to actual threats.
Organizations like Reserving.com, ChargePoint, Yext, Upwork and Cimpress leverage Hunters SOC Platform to empower their safety groups. Hunters is backed by main VCs and strategic buyers together with Stripes, YL Ventures, DTCP, Cisco Investments, Bessemer Enterprise Companions, U.S. Enterprise Companions (USVP), Microsoft’s enterprise fund M12, Blumberg Capital, Snowflake, Databricks, and Okta.
Contact
Yael Macias
[email protected]