I'm pretty impressed with the GCP response, both the fact that they identified the behavior and took the first step in reaching out.

I don’t know why, but I was disappointed they didn’t disclose how much the reward was.

Oh boy someone's not going to have a fun long weekend

Last time I checked, their hosted databases run in dedicated VMs, which is where the real security boundary is.

Getting access to the host OS won't give you much other than some internal binaries and config.

Remember that MS SQL server isn't Google code... Any vulnerabilities it may contain they might be powerless to fix.

Considering that, Google probably has an extensive monitoring system running in the VM, looking for things happening that shouldn't happen... And they have probably also built a filtering infrastructure between the users and the SQL server so that if any vulnerability is found, they can at least filter attempts to exploit it while a fix is being made.

There is a probably a good reason why they didn't elaborate on this:

"Our research began when we identified a gap in GCP’s security layer that was created for SQL Server."

It would have been interesting to see how they identified that security gap.

[flagged]

So this blog post is missing any information about what the actual vulnerabilities were. What was the "gap"? What was the misconfiguration? Also missing is whether access to the host VM exposes meaningful secrets. Does this actually risk customers' sensitive data?

Isn’t the blur effect too light on the screenshots? I may be possible to recompute the /etc/shadow file.

"With access to the operating system, we managed to find some internal Google URLs related to the docker image repository. We could also access the internal repo which later was fixed and the access from non internal IPs was blocked."

Fascinating how sloppy some people are when they set up infrastructure even though this may be down to bad defaults.

The vulnerability sounds like it's inherent to SQL Server, and that cloud providers haven't been successful in blocking the underlying problem due to its proprietary nature.

Presenting it as a Cloud SQL problem is disingenuous.

This article is lacking the actual interesting bit, which is how was the escalation achieved? Just reads like bragging instead of being informative.