Google Cloud Platform vulnerability enables privilege escalation by attackers

TLDR:

• A vulnerability named “ConfusedFunction” in Google Cloud Platform (GCP) allows attackers to escalate privileges and gain unauthorized access to GCP services.
• The vulnerability affects both first- and second-generation Cloud Functions and involves exploiting the default Cloud Build service account.

Article Summary:

A newly discovered vulnerability in Google Cloud Platform (GCP) known as “ConfusedFunction” allows attackers to escalate privileges and access GCP services. Tenable Research identified this flaw in the Cloud Functions and Cloud Build services of GCP, which could potentially pose significant security risks. The vulnerability occurs during the deployment process of a Cloud Function, where the default Cloud Build service account with excessive permissions can be exploited by attackers.

The technical details of the vulnerability reveal that the default Cloud Build service account attached to the Cloud Build instance has broad permissions and is hidden from ordinary users. By injecting malicious dependencies into the function’s deployment process, attackers can run code on the Cloud Build instance and extract the service account token, allowing them to escalate privileges.

Tenable Research demonstrated the exploitation process using a Node.js function, highlighting the method attackers can use to extract the service account token. While GCP implemented partial remediation for accounts created after mid-June 2024, existing Cloud Build instances remain vulnerable. Tenable recommends replacing legacy Cloud Build service accounts with least-privilege service accounts for each cloud function and taking preventive actions to secure environments.

The ConfusedFunction vulnerability emphasizes the potential security pitfalls of modern cloud services. Organizations using GCP must remain vigilant and proactive in securing their cloud environments to mitigate the risk posed by such vulnerabilities. Understanding service interactions and permissions is crucial for protecting against similar security threats in the future.