Case Study: Google Cloud identifies and remediates GCP SSH vulnerabilities with CloudQuery

Google Cloud identifies GCP SSH vulnerabilities in 6 minutes with CloudQuery

The customer, Google Cloud, faced the challenge of identifying and mitigating a critical OpenSSH vulnerability (CVE-2024-6387) within its Google Compute Engine (GCE) and Google Kubernetes Engine (GKE) environments. This security flaw could allow remote, unauthenticated attackers to execute arbitrary code as root on affected machines, requiring a swift method to locate all potentially vulnerable assets across its cloud infrastructure.

The vendor, CloudQuery, provided a solution using its open-source CLI tool to export Google Cloud's GCP data into a PostgreSQL database. By running specific SQL queries against the exported data, Google Cloud was able to quickly identify active firewall rules allowing SSH access and public GKE clusters, enabling them to prioritize and remediate the highest-risk exposures immediately. This use of CloudQuery delivered rapid, actionable insights to help secure its environment against this critical threat.

Google Cloud