Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Exploring a Critical Risk in Google Workspace's Domain-Wide Delegation Feature

Summary: Unit 42 researchers found that a GCP identity with the necessary permission can generate an access token to a service account granted domain-wide delegation in Google Workspace, letting a malicious insider or attacker with stolen credentials impersonate Workspace users and reach their emails, documents and other data. The researchers say the risk is a mismatch between the modest GCP permissions needed to misuse the feature and the impact it allows, and that they have discussed the issue with Google since June 2023, with Team Axon also reporting it.

Key Takeaway: A developer with editor rights in a GCP project, or an attacker holding a compute engine default service account token, can pivot from GCP into impersonating Workspace users across the domain - and the researchers note the full picture only emerges by correlating audit logs from both platforms.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Data Breaches
Related