Summary
Executing Cloud Functions in any project and in any organization allows bypassing the GKE Authorized Networks (aka Kubernetes
control plane firewalls) of a cluster in a different project or organization.
Affected Services
GKE
Remediation
None required
Tracked CVEs
No tracked CVEs
References
https://cloud.google.com/blog/products/identity-security/updates-coming-for-authorized-networks-and-cloud-runfunctions-on-gkehttps://twitter.com/itspeterc/status/1534205155914264576
Contributed by https://github.com/mer-b
Disclosure Date
Wed, Mar 9th, 2022
Exploitablity Period
ongoing
Known ITW Exploitation
-
Detection Methods
-
Piercing Index Rating
-
Discovered by
Peter Collins
