Researcher Shows How One File Can Seize Google Cloud Control
A security flaw allows a developer to grant themselves full admin rights over a Google Cloud organization using a simple configuration file.
Key points
- A user with limited Kubernetes access can exploit KCC to gain full admin rights over a Google Cloud organization.
- The flaw occurs because KCC uses its own high-privilege account to execute requests without verifying the user's actual authority.
- The attack, named ConfigConfusion, requires only the ability to create specific resource files in a watched namespace.
Security researcher Justin O'Leary has detailed a flaw in Google Kubernetes Config Connector. The issue allows a user with limited access to gain full control of a cloud organization. This risk stems from how the system handles permissions for its internal service account.
Varonis explains that this "confused deputy" problem turns a single file into a path for privilege escalation. The vulnerability exists because the system trusts its own high-level credentials to act on behalf of lower-level users without sufficient checks.
Centralizing credentials creates a shared risk
Companies often struggle with scattered cloud credentials. These keys can be lost, copied, or left on old devices. This mess makes it hard to audit who has access to what data.
To solve this, teams use a controller that manages cloud resources. Developers write simple configuration files and submit them to a code repository. The controller then uses its own high-level account to create the necessary resources in the cloud.
The flaw in the trusted controller
The controller, known as KCC, often holds broad organization-level permissions. It needs these rights to manage infrastructure across many different projects and folders. However, it does not strictly check if the specific user requesting a change actually deserves that power.
If an attacker can write to a specific namespace watched by KCC, they can exploit this. They can instruct the controller to grant themselves the "owner" role. This role provides full administrative control over the entire Google Cloud organization.
One file grants total ownership
The attack requires only access to a Kubernetes namespace. The attacker does not need their own Google Cloud credentials. They simply submit a file that tells the controller to assign them high-level rights.
BleepingComputer reports that this technique is called ConfigConfusion. It highlights a trade-off: centralizing security operations can inadvertently create a massive single point of failure. If the controller is compromised, the entire cloud environment is at risk.
