Vulnerabilities in the Google App Engine cloud platform make it possible for attackers to break out of a first-level security sandbox and execute malicious code in restricted areas of Google servers, a security researcher said Friday.
Adam Gowdiak, CEO of Poland-based Security Explorations, said there are seven separate vulnerabilities in the Google service, most of which he privately reported to Google three weeks ago. So far, he said, the flaws have gone unfixed, and he has yet to receive confirmation from Google officials. To exploit the flaws, attackers could use the freely available cloud platform to run a malicious Java application. That malicious Java app would then break out of the first sandboxing layer and execute code in the highly restricted native environment.
Malicious hackers could use the restricted environment as a beachhead to attack lower-level assets and to retrieve sensitive information from Google servers and from the Java runtime environment. Technical details about the bugs, noted as issues 35 through 41, are available here, here, here, and here. In an e-mail to Ars, Gowdiak wrote:
[A] malicious Java app could use them to escape this Google-specific sandbox as well as the Java-based sandbox. As a result, a lot of information about the JRE sandbox itself [and] Google internal services and protocols could be gained by an attacker (the middleware layer Google runs on).
The vulnerabilities also seem to be a potentially good starting point to proceed with attacks against the OS sandbox and RPC (remote procedure call) services visible to the sandboxed Java environment.
Please note that we haven't reached a point in our research where we could state that arbitrary compromise of other GAE user's data or applications is possible (per agreement with Google, during our research we stayed within the JVM layer and did not move to the next sandboxing layer).
Gowdiak took to the Full Disclosure e-mail list to disclose the bugs and to call Google out for not responding to his private advisory, which he said included proof-of-concept exploit code.
"It's been 3 weeks and we haven't heard any official confirmation / denial from Google with respect to Issues 37-41," Gowdiak wrote. "It should not take more than 1-2 business days for a major software vendor to run the received POC, read our report and / or consult the source code. This especially concerns the vendor that claims its 'Security Team has hundreds of security engineers from all over the world' and that expects other vendors to react promptly to the reports of its own security people."
Google has received criticism in the past when its Project Zero has disclosed vulnerabilities in Windows and Mac OS X before Microsoft and Apple had patched them.Asked for comment on Gowdiak's Full Disclosure post, a Google spokesman issued the following statement: "A researcher recently reported a known issue affecting a preliminary layer of security in Google App Engine. We’re working with him to mitigate it; users don’t need to take any action."
reader comments
75