With Complex Cloud Integrations, Small Errors Lead to Major Compromises
This article details a near-breach at Zapier, a popular low-code automation service, highlighting the risks associated with complex cloud integrations and inadequate security practices. Researchers at Token Security discovered a five-stage exploit chain that leveraged over-permissioned roles, secrets discovery, and non-human identities to gain significant control over Zapier's environment, potentially allowing for data theft and malicious code deployment. The incident underscores the growing complexity of SaaS infrastructure and the need for robust security measures, particularly around managing access and secrets.
The research by Token Security revealed a concerning vulnerability within Zapier’s low-code automation platform. Researchers successfully exploited a chain of events, starting with the ability to write custom code within Zapier’s environment, utilizing Python and JavaScript scripts to manipulate data and interact with the platform. This initial access allowed them to identify that Zapier was running on AWS Lambda and discover an overly permissive role, named ‘allow_nothing_role’, which inadvertently exposed sensitive information. The researchers then extracted secrets from memory, facilitated by the lack of proactive credential deletion in AWS Lambda, and subsequently gained access to Zapier’s private repository, uncovering an NPM token for package publishing. This chain of events demonstrates how seemingly innocuous features – like allowing users to write custom code – can create pathways for attackers to compromise a system.
The incident highlights the broader challenges of securing increasingly complex SaaS environments. The article notes that 56% of companies lack a process to track SaaS-to-SaaS connections, and the rise of agentic AI swarms is further compounding this issue. The near-breach at Zapier underscores the importance of meticulous role management, secure credential handling, and proactive monitoring of integrations. The research team’s findings, coupled with the fact that the issue was resolved within a week of notification, demonstrates the potential impact of early detection and rapid remediation.
Furthermore, the article references previous incidents, such as UNC6395’s exploitation of Salesforce instances via OAuth tokens, illustrating a recurring pattern of vulnerability stemming from misconfigured access controls. The overall message is clear: overly permissive access, combined with inadequate security practices, can create significant risks for organizations relying on complex cloud integrations.