#AttachMe Oracle Cloud Vulnerability

There are 2,685 companies using Oracle Cloud. Some of these companies include Airbnb, adidas, Bank of America, Labcorp, Toyota, Fedex, Experian, and many more [5].  The lack of authorization checks would ensure the attacker had read/write privileges over the target volume, whether or not they had sufficient permissions. As a result, it may have been possible for attackers to leverage this avenue to steal or modify information, search for cleartext secrets, or move laterally across the volume. “This could lead to severe sensitive data leakage for potentially all Oracle Cloud Infrastructure (OCI) customers and in some scenarios could even be exploited to gain remote code execution on their environment, providing an initial entry point for further movement in the victim’s cloud environment” said Wiz researcher Sagi Tzadik [3].  a potential attacker could have performed numerous serious actions which include exfiltrate sensitive data stored on the volume, search the volume for cleartext secrets in order to move laterally through the victim’s environment and/or escalate privileges, and alter existing block volumes and boot volumes—e.g. by manipulating binaries—in order to gain code execution when the volumes were mounted on compute instances [1]. The impact of the vulnerability could have been severe if it was not patched so rapidly upon notification.