Oracle Cloud admits users could access other customer data TechRadar Skip to main content TechRadar is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Here's why you can trust us. Oracle Cloud admits users could access other customer data By Sead Fadilpašić published 21 September 2022 Lack of permissions verification in the AttachVolume API caused a lot of trouble (Image credit: Oracle) Audio player loading… A vulnerability in Oracle Cloud Infrastructure (OCI) could have allowed basically any user to read and write data belonging to any other OCI customer, researchers have claimed. Experts from cloud security firm Wiz said they stumbled upon the vulnerability when building an OCI connector for their own tech stack, discovering that they could attach other people's virtual disks to their virtual machine instances. Our cloud storage guides (Image credit: Image by Wilfried from Pixabay )Best cloud storage: Expand your storage easily Best cloud backup: Protect your data on the go Best cloud storage for photos: Space for your photos Best business cloud storage: Data resilience for business Best free cloud storage: Bits and bytes online for free The only thing they'd need is that other person's storage volume Oracle Cloud Identifier, and that the other person's volume supported multi-attachment (or wasn't already attached). With all these things aligned, a potential threat actor would be able to access any sensitive information found on the volume - and to make matters worse, they'd also be able to write over it. Code execution Describing the findings in a blog post (opens in new tab), Wiz's Elad Gabay said the flaw "could be used to manipulate any data on the volume, including the operating system runtime (by modifying binaries, for example), thus gaining code execution over the remote compute instance and a foothold in the victim's cloud (opens in new tab) environment, once the volume is used to boot a machine." Oracle moved quickly to remedy the vulnerability. After learning of the flaw, it fixed it within 24 hours, Gabay further stated, with no additional action was needed from the customers. The Register spotted a Twitter thread by Wiz's head of research, Shir Tamari, in which it was explained that the key problem lay in the lack of permissions verification in the AttachVolume API. What we don't know is whether or not anyone managed to abuse the flaw while it was active, and if they did, was it just to steal data, or to distribute malware, or even ransomware. So far, there is no evidence that something like that happened. We've reached out to Oracle, whose representatives said the company would not be commenting. These are the best cloud storage management services (opens in new tab) right now Via: The Register (opens in new tab) Sead Fadilpašić Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he's written for numerous media outlets, including Al Jazeera Balkans. He's also held several modules on content writing for Represent Communications. See more Computing news Are you a pro? Subscribe to our newsletter Sign up to theTechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Thank you for signing up to TechRadar. You will receive a verification email shortly. There was a problem. Please refresh the page and try again. MOST POPULARMOST SHARED1The iPhone 14 Pro is made of the wrong stuff; the Pixel 7 proves that to me27 new movies and TV shows on Netflix, Prime Video, HBO Max and more this weekend (October 7)3Stop saying Mario doesn't have an accent in The Super Mario Bros. Movie4Microsoft Teams users are using it for a really bad reason, so stop now5Google Pixel Tablet is what Apple should've done ages ago1Best laptops for designers and coders 2The iPhone 14 Pro is made of the wrong stuff; the Pixel 7 proves that to me3Stop saying Mario doesn't have an accent in The Super Mario Bros. Movie4Microsoft Teams users are using it for a really bad reason, so stop now5iPhone 15 tipped to come with an upgraded 5G chip Technology Magazines (opens in new tab)● (opens in new tab)The best tech tutorials and in-depth reviewsFrom$12.99 (opens in new tab)View (opens in new tab)