rage.fail

gcp-workflows-exposes-runtime-sa

Any code running inside a workflow (via definition control) can exfiltrate the runtime SA token via an outbound http.request step to an attacker-controlled endpoint.

derived gcp emits ExposesCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'workflow': None} ExecutesAs {'sa': None}

where

node_type(?workflow) == Workflow

emit

source type	`Messaging`
target type	`Identity`
source	`<workflow>`
target	`<runtime service account>`

Narrative

{workflow.name} exposes the runtime service account {sa.name}'s token to any code running inside it - an injected step can exfiltrate the OAuth2/OIDC token via an outbound HTTP request.

Raw rule rules/derived/gcp/workflows.yaml

id: gcp-workflows-exposes-runtime-sa
emits: ExposesCredential
description: Any code running inside a workflow (via definition control) can exfiltrate the runtime SA
  token via an outbound http.request step to an attacker-controlled endpoint.
match:
- - workflow: null
  - ExecutesAs
  - sa: null
where:
- node_type(?workflow) == Workflow
emit:
  source_type: Messaging
  target_type: Identity
  source: <workflow>
  target: <runtime service account>
  permissions: []
  derived_from:
  - ?workflow ExecutesAs ?sa (gcp-workflows-explicit-executes-as)
  note: 'Workflows does not have a metadata server endpoint like GCE/Cloud Run; the SA token is accessed
    via the googleapis.com token endpoint using the runtime context. An attacker-controlled step can use
    the built-in auth.type: OAuth2 or OIDC to obtain the token and post it outbound. This edge only becomes
    an attack step when combined with CanModifyCode (definition control).'
  false_positive_note: Not an escalation by itself. Path value comes from a contributing CanModifyCode
    or CanExecuteAs edge. The token is accessible only within a running execution; executions.create (CanInvoke)
    or an existing trigger is still required.
  narrative: "{workflow.name} exposes the runtime service account {sa.name}'s token to any code running\
    \ inside it \u2014 an injected step can exfiltrate the OAuth2/OIDC token via an outbound HTTP request."