Google Looker Studio Vulnerabilities - Data Exfiltration Risk

What Happened

A set of nine vulnerabilities in Google Looker Studio, collectively known as LeakyLooker, was discovered by Tenable researchers. These vulnerabilities allowed attackers to run arbitrary SQL queries and exfiltrate sensitive data from Google Cloud environments. This was possible without victims granting explicit permission, raising significant security concerns. Google has since fully remediated all identified issues following responsible disclosure.

Google Looker Studio, previously known as Data Studio, is a cloud-based platform that connects to various data sources to create shareable reports. However, its architecture, which relies on a permission-sharing model similar to Google Docs, became a security weakness. The vulnerabilities stem from how Looker Studio handles authentication, leading to two exploitable attack paths.

Who's Affected

The vulnerabilities primarily affect users of Google Looker Studio who connect their reports to databases such as BigQuery, PostgreSQL, and MySQL. Any organization relying on this platform for data visualization and reporting could potentially be at risk. Although there is no evidence that these vulnerabilities were exploited in the wild, the implications for data security are significant, especially for businesses managing sensitive information.

What Data Was Exposed

The vulnerabilities allowed attackers to access and manipulate data across various Google Cloud environments. For instance, attackers could execute arbitrary SQL commands, potentially leading to the deletion or modification of records. The most severe vulnerability allowed attackers to bypass Google’s input filters, which could result in full SQL execution across the report owner's entire Google Cloud project. This means sensitive data could have been extracted without the owners' knowledge.

What You Should Do

Organizations using Google Looker Studio should take immediate action to ensure their data security. Here are some recommended steps:

• Audit user access: Review all users with 'View' access to Looker Studio reports, both public and private.
• Revoke unnecessary access: Remove access for any data source connectors that are no longer in active use.
• Follow Google’s guidelines: Refer to Google’s documentation to review and restrict Looker Studio’s access to connected services.

By taking these precautions, organizations can better protect their data and minimize risks associated with these vulnerabilities.