GCP
GCP misconfigurations that commonly lead to data exposure and privilege escalation. Each subpage includes description, proof, and remediation.
In this section
- GCS Public BucketsobjectViewer) or when legacy object ACLs remain after enabling uniform bucket-level access (UBLA).
- Service Account Over-Privilege and KeysOver‑privileged service accounts (SAs) and long‑lived user‑managed keys enable broad access across projects and offline abuse if stolen.
- Metadata Server SSRF and Default Scopesinternal) can steal access tokens for the attached service account.
- Cloud SQL Public ExposureCloud SQL instances with public IPs and permissive authorized networks are reachable from the internet, enabling brute‑force and exploit attempts.
- IAM Misconfig and Lateral MovementserviceAccountTokenCreator on powerful service accounts allows impersonation or token minting, enabling lateral movement across projects.
- Cloud Functions/Run UnauthenticatedAllowing unauthenticated invocation (allUsers invoker) exposes Cloud Functions or Cloud Run services publicly,…
- Audit Logging and Retention GapsDisabling Admin or Data Access logs, not exporting logs centrally, or using short retention windows reduces…
- VPC Firewall Open Ingress0/0 (or broad ranges) to sensitive ports (SSH/RDP/DB/ICMP) expose workloads to the internet, increasing exploit and brute‑force risk.
Last updated
