gcp-lb-target-proxy-url-map

id: gcp-lb-target-proxy-url-map
emits: CanModifyConfiguration
description: compute.targetHttpsProxies.setUrlMap (or compute.targetHttpProxies.setUrlMap) changes the
  URL map bound to an existing target proxy. An attacker can swap the URL map without touching the forwarding
  rule, redirecting all traffic through the target proxy to an attacker-controlled URL map and backend
  service. This achieves traffic hijack and IAP bypass without requiring setTarget on the forwarding rule.
match_effective_permission:
  action: compute.targetHttpsProxies.setUrlMap
  resource_type: compute.googleapis.com/TargetHttpsProxy
alt_permission: compute.targetHttpProxies.setUrlMap
emit:
  source_type: Identity
  target_type: LoadBalancer
  source: <principal>
  target: <TargetHttpsProxy or TargetHttpProxy in scope>
  permissions:
  - compute.targetHttpsProxies.setUrlMap
  - compute.targetHttpProxies.setUrlMap
  conditions:
  - iam_permission
  escalation: setUrlMap on a target proxy changes the URL map that proxy evaluates for all incoming traffic.
    Attacker creates an attacker-controlled URL map and backend service, then calls setUrlMap on an existing
    target proxy bound to a public forwarding rule. All client traffic through that proxy (including session
    cookies, authorization headers, and POST bodies) is now forwarded to the attacker's backend AFTER
    TLS termination at the GFE.
  false_positive_note: compute.targetHttpsProxies.setUrlMap requires the new URL map to already exist
    and the principal to hold compute.urlMaps.use on it. Creating a net-new URL map additionally requires
    compute.urlMaps.create. For target HTTP proxies (non-HTTPS), use compute.targetHttpProxies.setUrlMap.
    This mutation is a distinct attack from compute.globalForwardingRules.setTarget; both achieve traffic
    hijack but via different resource mutation points. The impact is identical when the target proxy is
    bound to a public forwarding rule.
  narrative: '{principal.name} can call setUrlMap on target proxy {target.name} (compute.targetHttpsProxies.setUrlMap
    / compute.targetHttpProxies.setUrlMap), replacing the URL map the proxy evaluates. All traffic flowing
    through this target proxy (from its bound public forwarding rule) is now routed to an attacker-controlled
    URL map and backend. TLS terminates at the GFE; the attacker''s backend receives decrypted HTTP traffic
    including session cookies and authorization headers.'