gcp-lb-urlmap-update

id: gcp-lb-urlmap-update
emits: CanModifyConfiguration
description: compute.urlMaps.update (global URL maps) and compute.regionUrlMaps.update (regional URL maps)
  rewrite host rules, path matchers, and default service. An attacker can redirect specific paths or entire
  hostnames to attacker-controlled backend services, intercept decrypted application traffic, or route
  paths to a backend service NOT protected by IAP (bypassing authentication on those paths while leaving
  IAP visually enabled on the URL map).
match_effective_permission:
  action: compute.urlMaps.update
  resource_type: compute.googleapis.com/UrlMap
alt_permission: compute.regionUrlMaps.update
emit:
  source_type: Identity
  target_type: LoadBalancer
  source: <principal>
  target: <UrlMap or RegionUrlMap in scope>
  permissions:
  - compute.urlMaps.update
  - compute.regionUrlMaps.update
  conditions:
  - iam_permission
  escalation: '(a) Selective path hijack: modify pathMatchers[].pathRules[] to route /api/* or /login
    to an internet NEG pointing to an external attacker host. The LB terminates TLS and forwards decrypted
    HTTP to the attacker. All POST bodies, cookies, and authorization headers in matched requests are
    captured. (b) IAP bypass per-path: route specific paths (e.g. /admin/*, /metrics) to a backend service
    with iap.enabled=false; those paths are now unauthenticated even though the URL map is associated
    with IAP-protected backend services for other paths. (c) Full hostname redirect: override hostRules[]
    to send an entire virtual host to an attacker backend; requires compute.urlMaps.update or compute.regionUrlMaps.update
    plus compute.backendServices.use on the target backend service.'
  false_positive_note: compute.urlMaps.update and compute.regionUrlMaps.update are distinct permissions;
    global LBs use compute.urlMaps.update, regional Application Load Balancers use compute.regionUrlMaps.update.
    Verify the scope (global vs regional) against the LB resource type. The new backend service target
    must already exist and the principal must hold compute.backendServices.use on it. Creating a net-new
    backend service additionally requires compute.backendServices.create. For IAP-bypass impact, the URL
    map must be associated with an LB that serves IAP-protected traffic; impact is lower if no IAP is
    present. Changes take effect immediately (typically within seconds to minutes via GFE propagation).
  narrative: '{principal.name} can rewrite URL map {target.name} (compute.urlMaps.update or compute.regionUrlMaps.update
    for regional LBs), redirecting specific paths or hostnames to attacker-controlled backend services.
    TLS terminates at the GFE, so the attacker''s backend receives decrypted HTTP traffic including session
    cookies and authorization headers. If IAP-protected paths are present, the attacker can route unprotected
    paths around IAP, selectively bypassing authentication.'