Summary
A vulnerability in Google Cloud Shell allowed escalation from XSS to full instance takeover as root. The attack exploited an XSS in the markdown preview functionality to read sensitive files, obtain the instance's private key and hostname, and gain SSH access as root. The issue affected the Eclipse Theia-based editor used in Cloud Shell.
Affected Services
Cloud Shell
Remediation
None required. The vulnerability was fixed by Google.
Tracked CVEs
No tracked CVEs
References
Contributed by https://github.com/korniko98
Entry Status
Stub (AI-Generated)
Disclosure Date
Thu, Feb 6th, 2020
Exploitablity Period
Until 2020/03/18
Known ITW Exploitation
-
Detection Methods
Monitor for unexpected SSH access to Cloud Shell instances, especially from external IP addresses. Review Cloud Shell access logs for anomalous activity.
Piercing Index Rating
-
Discovered by
Omar Espino
