Rapid7 InsightCloudSec resource.db() method access

Vulnerability

An authenticated attacker can leverage an exposed resource.db() accessor method in InsightCloudSec (formerly DivvyCloud) to smuggle Python method calls via a Jinja template. This affects Managed and SaaS deployments prior to February 1, 2023, and Self-Managed versions prior to 23.2.1 [2].

Exploitation

An attacker needs authenticated access with privileges to create or edit bots (Bot creator or Bot editor role). They can craft a bot that triggers a Jinja template containing malicious Python method calls via the resource.db() accessor. The bot is executed when a monitored resource matches the bot's filter conditions [1].

Impact

Successful exploitation allows the attacker to execute arbitrary Python code, leading to full code execution on the InsightCloudSec server, potentially compromising the entire cloud security management platform [1].

Mitigation

The issue is fixed in Managed and SaaS deployments as of February 1, 2023, and in Self-Managed version 23.2.1 [2]. Users should upgrade to version 23.2.1 or later for Self-Managed deployments. No workarounds are provided.