gcp-tasks-update-queue-config
cloudtasks.queues.update lets an attacker change the queue's httpTarget.uriOverride (redirect all dispatches to an attacker endpoint), httpTarget.oidcToken.serviceAccountEmail (with actAs - swap the token SA), headerOverrides, App Engine routing, or rate limits.
match (effective permission)
{
"action": "cloudtasks.queues.update",
"resource_type": "google.cloud.tasks.v2.Queue"
}
emit
| source type | Identity |
|---|---|
| target type | Queue |
| source | <principal> |
| target | <Cloud Tasks queue in scope> |
| permissions | cloudtasks.queues.update |
| conditions | iam_permission |
| state logic | ACTIVE when the principal has effective cloudtasks.queues.update on the queue. |
Narrative
{principal.name} has cloudtasks.queues.update on {queue.name} and can modify the queue's HTTP target configuration: redirect all dispatches via httpTarget.uriOverride (capturing OIDC tokens and payloads at an attacker endpoint), inject headers, or re-point the OIDC/OAuth SA (with actAs) to a privileged identity.
Raw rule rules/derived/gcp/tasks.yaml
id: gcp-tasks-update-queue-config
emits: CanModifyConfiguration
description: "cloudtasks.queues.update lets an attacker change the queue's httpTarget.uriOverride (redirect\
\ all dispatches to an attacker endpoint), httpTarget.oidcToken.serviceAccountEmail (with actAs \u2014\
\ swap the token SA), headerOverrides, App Engine routing, or rate limits."
match_effective_permission:
action: cloudtasks.queues.update
resource_type: google.cloud.tasks.v2.Queue
emit:
source_type: Identity
target_type: Queue
source: <principal>
target: <Cloud Tasks queue in scope>
permissions:
- cloudtasks.queues.update
conditions:
- iam_permission
state_logic: ACTIVE when the principal has effective cloudtasks.queues.update on the queue.
derived_from:
- 'effective permission: cloudtasks.queues.update on the queue resource'
false_positive_note: "Two distinct escalation sub-paths flow from cloudtasks.queues.update: (1) httpTarget.uriOverride\
\ change \u2014 no actAs required; immediately redirects all future dispatches to the attacker's endpoint\
\ where OIDC/OAuth tokens and task bodies are captured. High confidence once update is confirmed.\
\ (2) httpTarget.oidcToken.serviceAccountEmail change \u2014 requires iam.serviceAccounts.actAs on\
\ the chosen SA (API-enforced). Without actAs the SA change fails. Emit CanPassIdentity(principal\
\ \u2192 SA) separately (rule below) when actAs is confirmed. Note: update does NOT grant the principal\
\ any per-task override; it sets the queue-level default. IAM deny on cloudtasks.queues.update blocks\
\ both sub-paths."
narrative: '{principal.name} has cloudtasks.queues.update on {queue.name} and can modify the queue''s
HTTP target configuration: redirect all dispatches via httpTarget.uriOverride (capturing OIDC tokens
and payloads at an attacker endpoint), inject headers, or re-point the OIDC/OAuth SA (with actAs)
to a privileged identity.'