gcp-eventarc-publish-to-bus
Holding eventarc.messageBuses.publish on an Eventarc Advanced message bus lets an attacker inject arbitrary CloudEvents into the bus, driving all pipelines/enrollments bound to it - the direct Phase-10 publish primitive for Eventarc Advanced.
match (effective permission)
{
"action": "eventarc.messageBuses.publish",
"resource_type": "google.cloud.eventarc.v1.MessageBus"
}
emit
| source type | Identity |
|---|---|
| target type | EventBus |
| source | <principal> |
| target | <Eventarc Advanced message bus node that receives published events> |
| permissions | eventarc.messageBuses.publish |
| conditions | iam_permission service_state |
| state logic | ACTIVE when the principal holds eventarc.messageBuses.publish AND the message bus is ACTIVE. BLOCKED when an IAM deny or org policy denies the permission. CONDITIONAL when the bus has an event filter that may not match the attacker payload. |
Narrative
{principal.name} can publish events to the Eventarc Advanced message bus {bus.name} (eventarc.messageBuses.publish), injecting attacker-controlled CloudEvent payloads into all pipelines and enrollments bound to the bus.
Raw rule rules/derived/gcp/eventarc.yaml
id: gcp-eventarc-publish-to-bus
emits: CanWriteData
description: "Holding eventarc.messageBuses.publish on an Eventarc Advanced message bus lets an attacker\
\ inject arbitrary CloudEvents into the bus, driving all pipelines/enrollments bound to it \u2014 the\
\ direct Phase-10 publish primitive for Eventarc Advanced."
match_effective_permission:
action: eventarc.messageBuses.publish
resource_type: google.cloud.eventarc.v1.MessageBus
emit:
source_type: Identity
target_type: EventBus
source: <principal>
target: <Eventarc Advanced message bus node that receives published events>
permissions:
- eventarc.messageBuses.publish
conditions:
- iam_permission
- service_state
state_logic: ACTIVE when the principal holds eventarc.messageBuses.publish AND the message bus is ACTIVE.
BLOCKED when an IAM deny or org policy denies the permission. CONDITIONAL when the bus has an event
filter that may not match the attacker payload.
derived_from:
- 'effective permission: eventarc.messageBuses.publish on the message bus resource'
false_positive_note: "Publishing to the message bus injects events that are routed to all active pipelines\
\ and enrollments bound to the bus. The downstream CanTrigger edges (bus \u2192 pipeline/enrollment\
\ \u2192 consumer) must be confirmed from the bus's bound pipelines before claiming CanExecuteAs.\
\ This CanWriteData feeds messaging-chains rule 1 (messaging-publish-triggers-consumer) with the CanTrigger(bus\
\ \u2192 consumer) binding edge."
narrative: '{principal.name} can publish events to the Eventarc Advanced message bus {bus.name} (eventarc.messageBuses.publish),
injecting attacker-controlled CloudEvent payloads into all pipelines and enrollments bound to the
bus.'