services / Google Cloud / Compute Engine interconnect attachments

Interconnects provide connectivity between Compute Engine infrastructure and on-premises systems.

This privilege set may allow connection or disconnection of networks between multiple critical systems. To abuse creation of interconnects, multiple concurrent risks must be exploited, as abusing interconnects require access to a valid target on-premise facility, the ability to create interconnects, the ability to attach interconnects, and the ability to map interconnects to a compute router VLAN. The full set of privileges necessary to connect to a VLAN are: compute.interconnects.create, compute.interconnectAttachments.create, compute.interconnectAttachments.get, compute.routers.create, compute.routers.get, compute.routers.update.

compute.​interconnectsAttachments.​use

May allow an attachment to be used by an already compromised cloud router.

Risks

1. Network movement (BOOST)

Scope: MEDIUM

This privilege may grant access to confidential data, or its exploit can incur operational cost.

Links