IBM recently patched a vulnerability in IBM Cloud Databases for PostgreSQL that could have exposed users to supply chain attacks. The flaw was identified by cloud security company Wiz researchers, who gave it the name Hell’s Keychain.
It is a “first-of-its-kind supply-chain attack vector impacting a cloud provider’s infrastructure,” according to the company. “The flaw consists of a chain of three exposed secrets (CI/CD server credentials, private container registry password, and token for the Kubernetes service account), combined with overly lax network access to internal build servers.
Also Read: Strategies to Identify Database Security Threats and Vulnerabilities at Early Stage
The data stored in the PostgreSQL database could be read and modified remotely by malicious actors using this attack vector, according to Wiz. An attacker could have gained access to IBM Cloud repositories that hold the software prerequisites for PostgreSQL container images by using the exposed secrets.
Read More: IBM Cloud Vulnerability Exposed Users to Supply Chain Attacks
