New "LeakyLooker" Flaws in Google Looker Studio Could Enable Cross-Tenant SQL Queries

Tenable researchers disclosed nine cross-tenant vulnerabilities in Google Looker Studio, collectively named LeakyLooker, that could have allowed attackers to run arbitrary SQL queries on victims' databases.

• •Nine distinct flaws were identified, including zero-click SQL injection on database connectors, cross-tenant data source leaks, and a Denial of Wallet attack via BigQuery.
• •Attackers could exploit public or shared Looker Studio reports to clone them while retaining the original owner's credentials, enabling data deletion or modification.
• •A one-click exfiltration path allowed a specially crafted report to force the victim's browser to reconstruct entire databases from logs via an attacker-controlled project.
• •Affected connectors include BigQuery, Spanner, PostgreSQL, MySQL, Google Sheets, and Cloud Storage, potentially impacting any GCP organization.