gcp-cloudbuild-exposes-build-sa-cred

All Cloud Build steps can mint OAuth tokens for the build SA from the GCE metadata server; code execution in any step yields the build SA's credentials.

derived gcp emits ExposesCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Compute`
target type	`Identity`
source	`<Cloud Build build / worker pool node>`
target	`<build service account>`
state logic	ACTIVE: structural fact — GCE metadata server is always reachable from Cloud Build workers. This edge only becomes an attack step when combined with a CanModifyCode or CanExecuteAs edge.

source type

Compute

target type

Identity

source

<Cloud Build build / worker pool node>

target

<build service account>

state logic

ACTIVE: structural fact — GCE metadata server is always reachable from Cloud Build workers. This edge only becomes an attack step when combined with a CanModifyCode or CanExecuteAs edge.

Narrative

Code running in {build.name} build steps can retrieve OAuth 2.0 access tokens for build service account {sa.name} from the GCE metadata server (http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token), effectively granting all of {sa.name}'s IAM roles to any code in the build.

Raw rule rules/derived/gcp/cloudbuild.yaml

id: gcp-cloudbuild-exposes-build-sa-cred
emits: ExposesCredential
description: All Cloud Build steps can mint OAuth tokens for the build SA from the GCE metadata server;
  code execution in any step yields the build SA's credentials.
match:
- - ?build
  - ExecutesAs
  - ?sa
where:
- node_type(?build) in [BuildWorker]
emit:
  source_type: Compute
  target_type: Identity
  source: <Cloud Build build / worker pool node>
  target: <build service account>
  permissions: []
  conditions: []
  state_logic: "ACTIVE: structural fact \u2014 GCE metadata server is always reachable from Cloud Build\
    \ workers. This edge only becomes an attack step when combined with a CanModifyCode or CanExecuteAs\
    \ edge."
  confidence: 1.0
  derived_from:
  - <ExecutesAs edge_id for ?build -> ?sa>
  false_positive_note: "Not an escalation by itself \u2014 expresses the fact that code execution in the\
    \ build equals credential access for the build SA. Attack value is gated by an upstream execution-injection\
    \ capability (CanModifyCode / CanTrigger + attacker-influenced definition)."
  narrative: Code running in {build.name} build steps can retrieve OAuth 2.0 access tokens for build service
    account {sa.name} from the GCE metadata server (http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token),
    effectively granting all of {sa.name}'s IAM roles to any code in the build.