IBM has patched a first-of-its-kind cloud service provider (CSP) supply-chain vulnerability attack vector impacting the IBM Cloud databases for PostgreSQL-as-a-service infrastructure. The flaw has been coined “Hell’s Keychain,” by researchers, and if successfully exploited by attackers, could allow them to escalate their privileges to a superuser, make configuration changes, and execute arbitrary code. The vulnerability was identified and reported by security analysts from Wiz Research following a ROUTINE PostgreSQL-as-a-Service audit, stating “This is a first-of-a-kind supply-chain attack vector, showing how attackers might be able to leverage mistakes in the build process to take over the entire cloud environment.” The vulnerability exists due to two (2) fundamental flaws in the development of the architecture. First, the network access to sensitive internal build server infrastructure is overly permissive. Second, the scattering of plaintext credentials across the infrastructure exposes three (3) secret keys which can be identified and collected by the threat actor. A Wiz researcher stated that they successfully exploited the vulnerability by combining the chain of secret keys with the overly-permissive network link between Wiz’s personal PostgreSQL instance production environment and the IBM Cloud databases’ build environment, allowing the researchers to gain access to IBM Cloud’s internal build servers and manipulate artifacts within. Unfortunately, this cloud-based supply-chain attack vector is not limited to IBM and reveals a class of PostgreSQL vulnerabilities that affect most cloud vendors, including Microsoft Azure and Google Cloud. To prevent exploitation, administrators of IBM Cloud databases for PostgreSQL should ensure they are running the latest secure version of the infrastructure as well as exercising due care and due diligence through best practices. Wiz CTO Ami Luttwak recommends passive scanning at each stage of the pipeline as well as considering “image signing verification via admission controllers to ensure these sorts of attacks are prevented entirely.” A general best practice that isn’t limited to IBM is imposing strict network controls between the public-facing environment and the organization’s internal network. This novel type of vulnerability is likely to see an uptick in the future as threat actors around the world learn of this new cloud-based attack vector in supply-chains. The CTIX team will continue to monitor and report this type of activity to our readers.