Liv Matan

The Looker endpoint used for creating new projects from database connections allows specification of "looker" as a connection name, which is a reserved name for Looker’s internal MySQL database. The `schemas` parameter is susceptible to SQL injection, allowing manipulation of SELECT queries executed against the internal MySQL database. This allows users with developer permissions to extract data from Looker’s internal MySQL database. The API endpoint involved is the project generation endpoint. The vulnerable parameter is `schemas`.

A SQL injection issue exists in Looker Studio. A user with report view access can inject malicious SQL code that is executed with the permissions of the report owner. This affects reports utilizing BigQuery as the data source.

A SQL injection issue was identified in Looker Studio, potentially allowing unauthorized data exfiltration from BigQuery data sources. An attacker could create a malicious report with native functions enabled. When a victim accesses this report, the attacker could execute injected SQL queries using the victim’s permissions within BigQuery. The API endpoint used for this attack is not specified. The vulnerable parameter is not specified. The function `executeSQL()` is potentially involved.

An improper privilege management issue was identified in Looker Studio, affecting all JDBC-based connectors. A Looker Studio user with report view access could create a copy of a report and execute arbitrary SQL queries on the data source database, due to the stored credentials associated with the report.