Tomas Lažauninkas

Improper input validation in the CData JDBC driver integration allows an authenticated attacker to achieve remote code execution within the connector container. By using crafted JDBC connection string parameters, the attacker can also escalate privileges in the tenant project.

A Server-Side Request Forgery (SSRF) and Arbitrary File Read issue exists in AppSheet Core. An authenticated remote attacker can potentially read sensitive local files and access internal network resources by sending specially crafted requests to the production cluster.

A remote code execution (RCE) issue exists in Google Cloud Data Fusion. An attacker with the ability to upload artifacts to a Data Fusion instance can execute arbitrary code within the core AppFabric component. Successful exploitation could grant the attacker control over the Data Fusion instance, potentially leading to unauthorized data access, modification of data pipelines, and infrastructure exploration.

The Looker endpoint used for creating new projects from database connections allows specification of "looker" as a connection name, which is a reserved name for Looker’s internal MySQL database. The `schemas` parameter is susceptible to SQL injection, allowing manipulation of SELECT queries executed against the internal MySQL database. This allows users with developer permissions to extract data from Looker’s internal MySQL database. The API endpoint involved is the project generation endpoint. The vulnerable parameter is `schemas`.

The software contains a Command Injection issue stemming from inadequate file path sanitization, also known as Directory Traversal. An attacker possessing Developer permission can execute arbitrary shell commands when a user is deleted on the host system. This affects both Looker-hosted and Self-hosted instances. Looker-hosted instances have already been mitigated, requiring no user action. The issue is related to improper handling of file paths during user deletion, potentially allowing an attacker to traverse directories and execute commands on the underlying system. The vulnerability is triggered when a user with Developer permissions initiates a user deletion process.

Name of the Vulnerable Software and Affected Versions: Google SecOps SOAR Server versions prior to 6.3.54.0 Description: A path traversal flaw exists in the archive extraction component of Google SecOps SOAR Server. This allows an authenticated attacker with Use Case import permissions to achieve Remote Code Execution (RCE) by uploading a malicious ZIP archive containing path traversal sequences. Recommendations: Update Google SecOps SOAR Server to version 6.3.54.0 or later.

### Name of the Vulnerable Software and Affected Versions: Google Cloud Dataform (affected versions not specified) ### Description: A path traversal vulnerability exists in the NPM package installation process of Google Cloud Dataform. A remote attacker can read and write files in other customers' repositories by using a maliciously crafted `package.json` file. No customer action is required as Google has already applied mitigations. ### Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Google Cloud Application Integration (affected versions not specified) Description: A sandbox escape issue in the JavaScript Task feature of Google Cloud Application Integration allows an actor to execute arbitrary unsandboxed code via crafted JavaScript code executed by the Rhino engine. Effective January 24, 2025, Application Integration will no longer support Rhino as the JavaScript execution engine. Recommendations: No further fix actions are needed, as Application Integration will no longer support Rhino as the JavaScript execution engine starting January 24, 2025.