[sync] Add GCP.Cloudfunctions.Functions.Create rule (#58)

[egibs]

Goal

Detect cloudfunctions.functions.create method for privilege escalation in GCP.

Categorization

TA0004:T1548

Strategy Abstract

The Identity and Access Management (IAM) service manages authorization and authentication for a GCP environment. This means that there are very likely multiple privilege escalation methods that use the IAM service and/or its permissions.

Technical Context

For this method, we will be creating a new Cloud Function with an associated Service Account that we want to gain access to. Because Cloud Function invocations have access to the metadata API, we can request a token directly from it, just like on a Compute Engine instance.

The required permissions for this method are as follows:

cloudfunctions.functions.call OR cloudfunctions.functions.setIamPolicy

cloudfunctions.functions.create

cloudfunctions.functions.sourceCodeSet

iam.serviceAccounts.actAs

The script for this method uses a premade Cloud Function that is included on GitHub, meaning you will need to upload the associated .zip file and make it public on Cloud Storage (see the exploit script for more information). Once the function is created and uploaded, you can either invoke the function directly or modify the IAM policy to allow you to invoke the function. The response will include the access token belonging to the Service Account assigned to that Cloud Function.

Blind Spots and Assumptions

Assumes proper GCP logging and audit policies.

False Positives

Legitimate administrative activity that is authorized and expected.

Validation

The exploit scripts for this method can be found here and here and the prebuilt .zip file can be found here.

Priority

High or Critical

Response

Again, these are not vulnerabilities in GCP, they are vulnerabilities in how you have configured your GCP environment, so it is your responsibility to be aware of these attack vectors and to defend against them. Make sure to follow the principle of least-privilege in your environments to help mitigate these security risks.

Additional Resources

https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/