PT-2024-7334 · Google · Google Cloud Migrate To Containers

Published 2024-10-08 · Updated 2024-10-21 · CVE-2024-9858

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Google Cloud Migrate to Containers versions 1.1.0 through 1.2.2

Description: The issue is related to an insecure default user permission in Google Cloud Migrate to containers. A local user m2cuser is created with administrator privileges, posing a security risk if certain commands are interrupted or if the action to delete the local user m2cuser is skipped. This could impact the confidentiality, integrity, and availability of protected information.

Recommendations: For Google Cloud Migrate to Containers versions 1.1.0 through 1.2.2, upgrade to version 1.2.3 or beyond to resolve the issue. As a temporary workaround, consider deleting the local user m2cuser after use to minimize the risk of exploitation. Restrict access to the m2cuser account to prevent unintended access until the issue is resolved.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

BDU:2024-08690

CVE-2024-9858

Affected Products

Google Cloud Migrate To Containers

References · 12

• https://osv.dev/vulnerability/CVE-2024-9858 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-9858 · Security Note
• https://cloud.google.com/migrate/containers/docs/m2c-cli-relnotes#october_8_2024 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08690 · Security Note
• https://t.me/cvenotify/98243 · Telegram Post
• https://t.me/cvedetector/8043 · Telegram Post
• https://vuldb.com/?id.280615 · Note
• https://twitter.com/CVEnew/status/1846474968281850029 · Twitter Post
• https://tenable.com/cve/CVE-2024-9858/cpes · Note
• https://twitter.com/oktsec/status/1846500748797902943 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1846503764816978299 · Twitter Post
• https://twitter.com/cracbot/status/1848242929867128937 · Twitter Post