gcp-lb-set-target

id: gcp-lb-set-target
emits: CanModifyConfiguration
description: compute.globalForwardingRules.setTarget (or compute.forwardingRules.setTarget for regional)
  changes the target proxy of an existing forwarding rule. An attacker can re-point a public IP at an
  attacker-controlled target proxy/backend service, intercepting all traffic for the forwarding rule's
  hostname without touching the original backend or changing DNS.
match_effective_permission:
  action: compute.globalForwardingRules.setTarget
  resource_type: compute.googleapis.com/GlobalForwardingRule
alt_permission: compute.forwardingRules.setTarget
emit:
  source_type: Identity
  target_type: LoadBalancer
  source: <principal>
  target: <GlobalForwardingRule or ForwardingRule in scope>
  permissions:
  - compute.globalForwardingRules.setTarget
  - compute.forwardingRules.setTarget
  conditions:
  - iam_permission
  escalation: setTarget on a public global forwarding rule preserves the anycast IP and port while redirecting
    all matching traffic to a new target proxy. Attacker creates a target HTTPS proxy referencing an attacker-controlled
    URL map and backend service, then calls setTarget on the existing forwarding rule. All client traffic
    (including session cookies, authorization headers, and POST bodies) is now forwarded to the attacker's
    backend AFTER TLS termination at the GFE.
  false_positive_note: "compute.globalForwardingRules.setTarget requires the target to be a valid Compute\
    \ resource (TargetHttpProxy / TargetHttpsProxy / TargetTcpProxy) that exists in the same project.\
    \ The attacker must also hold permissions to create the target proxy and its URL map / backend service.\
    \ For regional forwarding rules use compute.forwardingRules.setTarget. This mutation affects INTERNAL\
    \ forwarding rules only within the VPC \u2014 scope impact accordingly for INTERNAL LBs. Also see\
    \ gcp-lb-target-proxy-url-map for the distinct attack of rewriting the URL map bound to an existing\
    \ target proxy (compute.targetHttpsProxies.setUrlMap / compute.targetHttpProxies.setUrlMap)."
  narrative: '{principal.name} can call setTarget on forwarding rule {target.name} (compute.globalForwardingRules.setTarget
    / compute.forwardingRules.setTarget), redirecting its public IP to an attacker-controlled target proxy.
    All traffic to {target.name}''s IP (including POST bodies and session tokens) flows to the attacker''s
    backend after TLS termination at Google''s Front End.'