gcp-memorystore-auth-string-grants-data-write

id: gcp-memorystore-auth-string-grants-data-write
emits: CanWriteData
description: Possession of the Redis AUTH string combined with in-VPC network reach grants full data-plane
  write access (SET, DEL, FLUSHALL, etc.), enabling cache poisoning and supply-chain injection attacks
  against dependent applications.
match:
- - principal: null
  - CanReadCredential
  - auth_string: null
- - instance: null
  - ExposesCredential
  - auth_string: null
where:
- node_type(?auth_string) == Credential
- node_type(?instance) == Cache
- node_class(?principal) in [Identity, Compute]
- ?principal has in-VPC network reachability to ?instance.host on port 6379 or 6380
emit:
  source_type: Identity
  target_type: Cache
  source: ?principal
  target: ?instance
  permissions:
  - redis.instances.getAuthString
  conditions:
  - iam_permission
  - network_reachability
  state_logic: 'ACTIVE when: (1) CanReadCredential input is ACTIVE (getAuthString permission held) (2)
    ExposesCredential input is ACTIVE (AUTH enabled on instance) AND (3) in-VPC network reachability to
    the Redis port is confirmed (VPC peering/Shared VPC, no blocking firewall rule on port 6379/6380).
    CONDITIONAL(network_reachability) when VPC topology is unresolved. CONDITIONAL(iam_permission) when
    CanReadCredential input is CONDITIONAL. BLOCKED if CanReadCredential is BLOCKED or if a VPC firewall
    rule blocks port 6379/6380.'
  confidence: min(contributing_confidences) * 0.9
  derived_from:
  - '<CanReadCredential: principal -> AUTH string Credential>'
  - '<ExposesCredential: instance -> AUTH string Credential>'
  - '<network_reachability confirmation: principal IP -> instance.host:6379/6380>'
  false_positive_note: 'Write access to Redis enables cache poisoning: an attacker can inject malicious
    data (SET key value) that downstream applications trust and consume, leading to RCE, privilege escalation,
    or data corruption. Cite credential-chains.yaml for the ContainsSecret->CanImpersonate roll-up when
    poisoned cached credentials flow back to downstream identity consumption. When network reach is unresolved,
    emit CONDITIONAL(network_reachability).'
  narrative: '{principal.name} can retrieve the AUTH string for {instance.name} and has network reach
    to the Redis port; it can authenticate via Redis AUTH and write to all keys (SET, DEL, FLUSHALL, CONFIG,
    etc.), enabling cache poisoning attacks against dependent applications.'