services / Google Cloud / Cloud Run Services

A Cloud Run service continuously runs code that responds to web requests or events. It will automatically scale the number of instances to match incoming requests.

Cloud Run services may be used to run core organizational infrastructure, such as web applications or REST APIs.

run.​services.​update

Allows an attacker to update settings for a service, including CPU/memory limits, autoscaling settings, the values of environment variables, the container entrypoint command and arguments, and egress/ingress network policy settings. Depending on the job and the contents of environment variables and arguments, this may allow the attacker to hijack the job for their own purposes, manipulate organizational data, or store output data in a location accessible to the attacker. Changing ingress/egress network policies can allow an attacker to make private services public or vice versa. Changing CPU/memory limits or autoscaling settings can incur spend, and changing autoscaling settings, network settings, or manipulating arguments/environment variables can create a DOS.

Risks

1. Data exfiltration (CRITICAL)
2. Data manipulation (HIGH)
3. Denial-of-service (HIGH)
4. Network movement (BOOST)
5. Defense destruction (EVASION)
6. Resource hijacking (MEDIUM)
7. Spend (MEDIUM)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links