How One Kubernetes YAML Can Hand Over a GCP Organization
A design flaw in Google's Kubernetes Config Connector allows attackers with namespace access to take over an entire GCP organization using a single YAML file.
Security researcher Justin O'Leary discovered 'ConfigConfusion,' a critical design flaw in Google Kubernetes Config Connector (KCC). The vulnerability allows a user with access to a Kubernetes namespace watched by KCC to escalate privileges to the owner of the entire Google Cloud organization by creating a single IAMPolicyMember resource. This occurs because KCC uses a service account with broad permissions to execute actions on behalf of users without checking if the originating Kubernetes user should be authorized for the resulting cloud action, creating a 'confused deputy' scenario.