Wiz Calls for a Standardized Cloud Vulnerability Database, Later Launches Open CVDB
Summary
Wiz argues that cloud vulnerabilities lack consistent identifiers, notifications and remediation tracking, using AWS, OMIGOD and ChaosDB as examples. The company later says it launched the community-driven Open CVDB in June 2022.
Key points
- Wiz says cloud vulnerabilities often lack standardized identifiers, severity ratings, notification channels and remediation tracking.
- AWS changed default policies and documentation after cross-account vulnerabilities were disclosed, but existing customers had to update their own configurations.
- OMIGOD affected Microsoft’s OMI agent, which was installed with some Azure services; Microsoft patched the vulnerabilities, but users lacked clear information about affected services.
- ChaosDB exposed Cosmos DB customer access keys; Microsoft asked affected customers to rotate keys manually, while the exposure timeframe was unclear.
- Wiz proposed a public, standardized database with vulnerability descriptions, severity, remediation steps and detection methods, populated by cloud providers.
- Wiz says it launched the community-driven Open CVDB in June 2022.
Article Details
- Topic
- The need for a standardized, public database for cloud vulnerabilities, informed by AWS cross-account vulnerabilities, OMIGOD, and ChaosDB.
Vendors
Amazonpopular AWS services. The source of these vulnerabilities was in the default access policies provided by Amazon to users. AWS provided users with over-permissive resource policies, allowing other AWS tenants toMicrosoftsecond example is one we called OMIGOD. OMIGOD was a set of 4 new vulnerabilities that we discovered in Microsoft’s OMI agent, which is cloud middleware used by many Azure services and silently installed on users'
Products
AWS Serverless Repository Serviceto read objects from S3 buckets integrated with itOne of the vulnerable services was the AWS Serverless Repository Service. The policy provided by Amazon for its users lacked scoping conditions, and the ServerlessAzure4 new vulnerabilities that we discovered in Microsoft’s OMI agent, which is cloud middleware used by many Azure services and silently installed on users' virtual machines by Microsoft when they set up these servicesAzure Automationon users' virtual machines by Microsoft when they set up these services (Azure Log Analytics, Azure Automation and more). These vulnerabilities enabled remote code execution and local privilege escalation atAzure Cosmos DBwas with ChaosDB. In August, 2021, we discovered an unprecedented service-level vulnerability in Azure Cosmos DB. Customers’ access keys were leaked, with access permissions to Cosmos DB databases of other cloudAzure Log Analyticsand silently installed on users' virtual machines by Microsoft when they set up these services (Azure Log Analytics, Azure Automation and more). These vulnerabilities enabled remote code execution and local