gcp-filestore-export-widen-to-data-access

id: gcp-filestore-export-widen-to-data-access
emits:
- CanReadData
- CanWriteData
description: When a principal holds CanModifyConfiguration (file.instances.update) on a Filestore instance
  and uses it to add an attacker-controlled IP to the NFS export rules, the principal's VM/container gains
  CanReadData and (if accessMode is READ_WRITE) CanWriteData to all files on the mounted share. This rule
  derives the data-plane access edges from the control-plane config mutation. State is POTENTIAL because
  the patch must be executed and network reachability must be confirmed.
match:
- - principal: null
  - CanModifyConfiguration
  - instance: null
where:
- node_type(?instance) == FileStorage
- ?principal also has (or controls a VM with) network-reachable IP addressable at the attacker's chosen
  CIDR range
- the export-rule patch (instances.patch) has been invoked by ?principal to add ?attacker_cidr
- ?attacker_vm IP falls within ?attacker_cidr
emit:
- edge_type: CanReadData
  source_type: Compute
  target_type: FileStorage
  source: ?principal
  target: ?instance
  permissions:
  - file.instances.update
  conditions:
  - iam_permission
  - network_reachability
  state_logic: 'POTENTIAL by default: the principal holds file.instances.update (CanModifyConfiguration)
    but has not yet invoked instances.patch to add their IP. Becomes ACTIVE when: (a) instances.patch
    has been executed (export rules widened to include attacker CIDR), (b) the attacker''s VM IP is confirmed
    within the new export range, (c) network connectivity (TCP/UDP 2049) is confirmed. BLOCKED if an IAM
    deny policy blocks file.instances.update or a VPC firewall blocks TCP/UDP 2049 to the instance IP
    after the export-rule change.'
  confidence: 0.95 when both export-rule patch confirmed and CIDR overlap verified
  derived_from:
  - gcp-filestore-export-rule-widen
  false_positive_note: 'CRITICAL: this edge is only materialized AFTER the export-rule widening is actually
    executed. Before the patch, the attacker cannot mount the share. Confirm that instances.patch was
    called with nfsExportOptions containing the attacker''s CIDR and READ_WRITE or READ_ONLY access mode.
    Network reachability must be independently verified: VM in same VPC, firewall rules allowing TCP/UDP
    2049, and no VPC SC perimeter blocking.'
  narrative: '{principal.name} widened the NFS export rules on {instance.name} to include their IP address
    {attacker_ip}, and can now mount the share via NFS and read all files.'
- edge_type: CanWriteData
  source_type: Compute
  target_type: FileStorage
  source: ?principal
  target: ?instance
  permissions:
  - file.instances.update
  conditions:
  - iam_permission
  - network_reachability
  match_condition: the widened export rule has accessMode == READ_WRITE
  state_logic: 'POTENTIAL by default. Becomes ACTIVE when export-rule widening has been executed with
    READ_WRITE access mode and network reachability confirmed. With NO_ROOT_SQUASH (the documented default),
    the client''s root user maps to the share''s root: attacker can plant setuid binaries, overwrite configs,
    or corrupt data. BLOCKED if the export rule is READ_ONLY or firewall blocks TCP/UDP 2049.'
  confidence: 0.95 when widening confirmed with READ_WRITE and network verified
  derived_from:
  - gcp-filestore-export-rule-widen
  narrative: '{principal.name} can mount {instance.name} with READ_WRITE access and modify or delete all
    files on the share.'