Google App Engine (GAE) is Google’s PaaS (Platform as a Service) Cloud computing Platform for developing and hosting web applications in Google-managed data centers. Lately, security researchers have discovered more than 30 critical vulnerabilities in the Java environment of the GAE that enables attackers to bypass critical security sandbox defenses.
Google App Engine (GAE) offers to run custom-built programs using a wide variety of popular languages and frameworks, out of which many are built on the Java environment. However, some security researchers of the security research company Security Explorations discovered a number of vulnerabilities. According to the security firm, the flaws can be exploited by attackers to achieve a complete Java VM security sandbox escape, as well as to execute an arbitrary code. The researchers have estimated that the number of issues is “30+ in total.”
On the other hand, by exploiting the vulnerabilities, security researchers were able to bypass Google App Engine whitelisting of JRE Classes and gain access to full JRE (Java Runtime Environment). They discovered 22 full Java VM security sandbox escape issues and were able to exploit 17 of them successfully. Apart from this, the researchers were able to execute native code, specifically to issue arbitrary library/system calls and to gain access to the files (binary/classes) comprising the JRE sandbox. They even siphoned off DWARF information from binary files, PROTOBUF definitions from Java classes and PROTOBUF definition from binary files among others.
As soon as Google came to know this fact, it suspended the researchers’ test Google App Engine account and hence, they were unable to finish their research.
Adam Gowdiak, founder and CEO of Security Explorations, said, “Unfortunately, we cannot complete our work due to the suspension of the “test” GAE account that took place today. Without any doubt this is an opsec failure on our end (this week we did poke a little bit more aggressively around the underlying OS sandbox/issued various system calls in order to learn more about the nature of the error code 202, the sandbox itself, etc.).”
As Google has generally been supportive and helpful to the security research community, researchers at the security firm believe that Google will allow them to complete their research and re-enable their Google App Engine account.
Do you think Google will re-enable the researchers’ Google App Engine account? Feel free to share your thoughts with us in the comments box below.