services / Google Cloud / Google Cloud SQL

Cloud SQL users are used to authenticate into Cloud SQL databases.

Cloud SQL is used to store and serve sensitive and application-critical data. Breach of a cloud SQL database can lead to exfiltration of highly sensitive data, or interruption of mission-critical applications.

cloudsql.​users.​update

Allows updating the password of an existing user.

Risks

1. Data destruction (CRITICAL)
2. Data exfiltration (CRITICAL)
3. Data manipulation (HIGH)
4. Denial-of-access (EVASION)
5. Logs destruction (EVASION)
6. Logs exfiltration (MEDIUM)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links