Wiz Finds OCI Flaw That Allowed Unauthorized Cross-Tenant Storage Access
Summary
Wiz found that attackers who knew a volume’s OCID could attach some OCI storage volumes to instances in another tenant, enabling unauthorized read/write access. Oracle fixed the flaw within 24 hours of being notified; no customer action was required.
Key points
- The flaw bypassed validation of the VOLUME_WRITE permission, allowing unauthorized attachment of volumes across OCI tenancies.
- An attacker needed the target volume’s OCID, an instance in the same Availability Domain, and a volume that was detached or configured for multi-attachment.
- Successful attachment enabled reading and modifying volume contents, with potential data theft, secret discovery, privilege escalation, or code execution through modified files.
- Wiz demonstrated the issue by attaching a volume despite lacking permissions and then viewing and modifying its contents.
- Wiz discovered the vulnerability on June 6, 2022, reported it to Oracle on June 9, and Oracle fixed it on June 10. No customer action was required.
- Wiz recommended rigorous code reviews, testing of sensitive APIs, service-specific penetration testing, and bug bounty programs.
Article Details
- Attack Vectors
- The AttachMe vulnerability allowed an attacker to attach a victim's detached or shareable OCI block or boot volume to a compute instance in the attacker's tenancy without authorization, if the attacker knew the volume's OCID and used an instance in the same Availability Domain.
- The article describes possible ways to obtain a volume OCID: searching online, including public GitHub projects, or reading it from an environment using low-privileged access.
- After attaching a volume, an attacker could read sensitive data and secrets or modify files, including binaries, potentially enabling code execution when the volume was used to boot a compute instance.
- Defensive Notes
- Oracle patched the vulnerability for all OCI customers within 24 hours of being informed; no customer action was required.
- The article recommends rigorous code reviews and comprehensive testing of sensitive APIs, service-specific penetration testing, and participation in bug bounty programs.
- The article notes that volume OCIDs should not be treated as secrets and recommends awareness that they may be exposed through public sources or accessible to low-privileged users and third-party vendors.
MITRE ATT&CK
T1530 · Data from Cloud StorageAfter unauthorized cross-tenant attachment, an attacker could read sensitive data and secrets stored on the victim's volume.T1565.001 · Stored Data ManipulationThe article describes modifying binaries and other data on an attached victim volume to enable later code execution when it is mounted on a compute instance.T1619 · Cloud Storage Object DiscoveryThe described attacker could enumerate available volumes and obtain their OCIDs by querying a victim's compartment or tenancy.