GatewayToHeaven Finding a Cross-Tenant Vulnerability in GCP'...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://omeramiad.com/posts/gatewaytoheaven-gcp-cross-tenant-vulnerability/
• Blog Title: GatewayToHeaven: Finding a Cross-Tenant Vulnerability in GCP's Apigee
• Suggested Section: GCP Pentesting -> Post Exploitation (Cloud Dataflow / Pub-Sub / Storage) and/or GCP -> Privilege Escalation (metadata token theft + IAM permission enumeration); add a technique note under GCP metadata SSRF about bypassing mitigations via header-stripping in gateways/proxies

🎯 Content Summary

Post: “GatewayToHeaven: Finding a Cross-Tenant Vulnerability in GCP's Apigee” (published 2026-01-28). The author describes a multi-step exploit chain in Google Cloud Apigee (managed SaaS) that resulted in cross-tenant read/write access to Apigee analytics/logging artifacts across unrelated customers, including logs containing plaintext end-user access tokens. The issue was assigned CVE-2025-13292.

High-level outcome (why this matters)<...

🔧 Technical Details

SSRF to cloud metadata via configurable API gateways/proxies: If a gateway/proxy can be configured to forward requests to arbitrary backends, pointing the backend to 169.254.169.254 can expose the workload’s metadata server and yield short-lived service-account tokens. If the platform injects SSRF-mitigation headers (e.g., X-Forwarded-For causing metadata rejection), look for request-mutation stages/policies (e.g., Apigee AssignMessage) that can remove/overwrite those headers before forwarding to the backend.

Cloud IAM permission discovery after token theft: After obtaining a service-account token, systematically enumerate effective permissions using automated tooling (e.g., gcpwn) to find high-leverage primitives like disk snapshotting, bucket read/write, and Pub/Sub publishing that enable deeper compromise and pivoting.

GCP disk snapshot exfiltration for ...

🤖 Agent Actions

Updated gcp-post-exploitation/README.md with a detailed Apigee-to-Dataflow cross-tenant exploitation chain: metadata SSRF bypass via AssignMessage header stripping, permission discovery with gcpwn, snapshot exfil for managed disks, Dataflow JAR replacement and GCS-based exfil, Pub/Sub-driven autoscaling trigger, and the shared bucket path flaw enabling cross-tenant analytics access. Added references to the source blog and Apigee AssignMessage policy docs.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://omeramiad.com/posts/gatewaytoheaven-gcp-cross-tenant-vulnerability/

Content Categories: Based on the analysis, this content was categorized under "GCP Pentesting -> Post Exploitation (Cloud Dataflow / Pub-Sub / Storage) and/or GCP -> Privilege Escalation (metadata token theft + IAM permission enumeration); add a technique note under GCP metadata SSRF about bypassing mitigations via header-stripping in gateways/proxies".

Repository Maintenance:

• MD Files Formatting: 575 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0