Wiz Details IBM Cloud PostgreSQL Flaw That Could Enable a Supply-Chain Attack
Summary
Wiz disclosed a PostgreSQL privilege-escalation and exposed-credentials chain in IBM Cloud Databases that enabled access to internal build repositories and a potential supply-chain attack path. IBM patched the issues; it reported no indication of further exploitation.
Key points
- Wiz said a SQL injection in a privileged PostgreSQL function enabled superuser queries and commands on the database’s underlying virtual machine.
- A Kubernetes service-account token found on the instance provided API access, including permission to retrieve known secrets.
- Wiz recovered private container registry credentials and found additional internal service credentials in container image build-history metadata.
- With those credentials and network access from the database environment to internal build servers, Wiz said it could overwrite files in repositories used to build PostgreSQL images.
- The demonstrated access established a potential supply-chain attack path; the article does not report that a malicious actor exploited it or that customers were affected.
- Wiz reported the findings to IBM Cloud, which said it fixed the issues for all customers by September 3, 2022; no customer action was required.
- IBM Cloud stated there was no indication its systems or services had been further exploited by other parties.
Article Details
- Attack Vectors
- A SQL injection in PostgreSQL's security-definer create_subscription function enabled arbitrary queries as the database superuser.
- The researchers used PostgreSQL's COPY statement to execute commands on the virtual machine hosting the database, then opened a reverse shell and scanned the internal network.
- A Kubernetes service-account token found in the pod allowed access to the Kubernetes API and retrieval of a named secret containing private container-registry credentials.
- The researchers pulled and scanned container images, including their individual layers, and found plaintext credentials in image build-history metadata.
- Overly permissive network access from the production database environment to internal build servers, combined with recovered repository credentials, allowed the researchers to overwrite files in packages used to build PostgreSQL images.
- Defensive Notes
- Continuously monitor environments for exposed or forgotten secrets, including credentials in container images and image layers.
- Enforce strict network controls between production and internal build environments.
- Restrict container-registry access and scope permissions to prevent unauthorized image retrieval and lateral movement.
- Review Kubernetes API access and service-account permissions to prevent unnecessary access to secrets, pods, and other resources.
- IBM Cloud reported that it patched the issues for all customers and fully mitigated them on 2022-09-03; it stated that there was no indication of further exploitation.
MITRE ATT&CK
T1046 · Network Service DiscoveryThe researchers performed a broad port scan of the internal IBM Cloud PostgreSQL service environment.T1059.004 · Unix ShellAfter gaining PostgreSQL superuser privileges, the researchers used COPY to execute commands on the underlying virtual machine and opened a reverse shell.T1078 · Valid AccountsThe researchers used recovered artifact-repository credentials to authenticate to internal build servers.T1190 · Exploit Public-Facing ApplicationThe researchers exploited SQL injection in PostgreSQL's create_subscription function in the managed database service.T1195.002 · Compromise Software Supply ChainWith the recovered credentials and internal network access, the researchers demonstrated they could overwrite files in packages used to build PostgreSQL images.T1552.001 · Credentials In FilesThe researchers found a Kubernetes service-account token in a file and credentials in container image build-history metadata.T1552.007 · Container APIThe researchers used Kubernetes API access to retrieve a named secret containing private container-registry credentials.T1613 · Container and Resource DiscoveryUsing kubectl and the Kubernetes API, the researchers listed pods in their namespace and inspected pod configurations.
People
Jerry BellIdentified in the article as CISO of IBM Cloud and quoted on the collaboration with Wiz.Nir OhfeldNamed member of the Wiz Research Team involved in the cloud security research.Ronen ShustinNamed member of the Wiz Research Team involved in the cloud security research.Sagi TzadikNamed member of the Wiz Research Team involved in the cloud security research.Shir TamariNamed member of the Wiz Research Team involved in the cloud security research.
Vendors
Products
IBM Cloud Databases for PostgreSQLHell’s Keychain, a first-of-its-kind, cloud service provider supply-chain vulnerability in IBM Cloud Databases for PostgreSQL. The vulnerability consists of a chain of three exposed secrets (Kubernetes service accountKubernetesin IBM Cloud Databases for PostgreSQL. The vulnerability consists of a chain of three exposed secrets (Kubernetes service account token, private container registry password, CI/CD server credentials) coupled withPostgreSQLthis blog post we will demonstrate how we were able to leverage a privilege escalation vulnerability in PostgreSQL to uncover a long-lasting secret that could have been abused to authenticate to internal IBM Cloud
Tools
detect-secretsetcd-mgmt-3.2.7, etcd-portal-3.2.7, etcd-portalmgmt-3.2.7, postgresql-mgmt-12.7) and utilized Yelp's detect-secrets tool to scan them for secrets.ibmcloud-cliFigure 6: Querying IBM Cloud’s IAM API regarding the retrieved keyWe then used the ibmcloud-cli to log in to the specific container registry with this key.kubectlSubsequently uploading the kubectl utility to the instance allowed us to use its features and perform operations more rapidly. We then ran the can-i command to inspect our current privileges and available resources and