A vulnerability in the Google Cloud Platform allows unauthorized privilege escalation. Creating or updating a Cloud Function inadvertently attaches a default Cloud Build service account with excessive permissions to a background Cloud Build instance.
It enables attackers to exploit the deployment process to gain control of the service account, potentially compromising Cloud Storage, Artifact Registry, and Container Registry services linked to the Cloud Function.
The ConfusedFunction vulnerability exploits complex inter-service dependencies in GCP to escalate privileges. While GCP’s fix mitigates the issue for new deployments, existing Cloud Build service accounts retain excessive permissions, leaving systems vulnerable.
Deploying Cloud Functions still necessitates granting broad permissions to the Cloud Build service account, creating an ongoing risk, while proactive monitoring and mitigation are crucial to prevent potential exploitation of this vulnerability.
The ConfusedFunction vulnerability exploits the hidden creation of a Cloud Build instance with broad permissions during Cloud Function deployment.
By default, GCP attaches a service account with excessive privileges to this Cloud Build instance, enabling an attacker who can create or update Cloud Functions to potentially escalate privileges and compromise other Google Cloud services like Container Registry, Cloud Storage, and Artifact Registry.
Researchers discovered an “npm install” command within Cloud Build instance logs associated with a Node.js Cloud Function, which raises concerns about potential code injection vulnerabilities, as user-controlled inputs could potentially manipulate the “npm install” command to introduce malicious code.
Such code execution within the Cloud Build environment could escalate privileges from the Cloud Function’s limited permissions to those of the default Cloud Build service account, granting unauthorized access to sensitive resources.
An attacker can exploit Cloud Build’s dependency installation process to escalate privileges from a Cloud Function. By including a malicious dependency with a preinstall script in the function’s package.json, the script can leverage the Cloud Build instance’s metadata service to access the default Cloud Build service account token.
It allows the attacker to impersonate the service account and gain its elevated permissions, effectively bypassing Cloud Function’s inherent limitations.
This exploit leverages a preinstall script in a malicious npm package to steal GCP tokens. An attacker first publishes a malicious package containing a preinstall script that retrieves a token from the Cloud Build service account metadata, and then they trick a Cloud Function with appropriate permissions into installing the package.
During installation, the preinstall script executes, stealing the Cloud Build service account token and sending it to a predefined webhook URL, which could be used for further malicious activity within the GCP environment.
Researchers at Tenable discovered a vulnerability (ConfusedFunction) that allowed attackers to leak the Cloud Build service account token via a malicious build script injected into the function’s source code (package.json/requirements.txt).
It could then be used to abuse the service account’s permissions. Google Cloud Platform addressed this issue by allowing users to choose a custom service account with limited permissions for Cloud Build deployments and also changing the default behavior to use the Compute Engine service account.
