Summary
An SSRF bug in GCP's Stackdriver Debugger feature's code import could have been used to leak the authentication
token of the user to an attacker-controlled server. Exploitation would require that the user had previously
configured a specific code hosting service (such as GitHub), and could be tricked into clicking a malicious link.
Affected Services
GCP Stackdriver Debugger
Remediation
None required
Tracked CVEs
No tracked CVEs
References
Contributed by https://github.com/ramimac
Disclosure Date
-
Exploitablity Period
-
Known ITW Exploitation
-
Detection Methods
-
Piercing Index Rating
-
Discovered by
Ron Chan
