Google Cloud Shell command injection

A vulnerability was discovered in Cloud Shell that enabled command injection and remote shell access.
By manipulating the "project" parameter, an attacker could have cause an unencoded Python script execution flaw.
Exploiting this flaw, they could inject a command to display the contents of the "/etc/passwd" file,
successfully execute arbitrary commands and obtain remote shell access. However, the impact of this is unclear,
as an attacker would seemingly only be able to gain such a remote shell on their own …

access cloud command command injection display etc exploiting file flaw google google cloud inject injection parameter project python python script script shell vulnerability