# What is your GCP infra worth?...about ~$700 [Bugbounty]

Open Jupyter Notebook on Tokopedia exposed a base64 GCP service account key, letting the researcher authenticate to GCP, list BigQuery billing tables, and SSH to internal hosts.

- Payout: $566
- Severity: critical
- Program: Tokopedia
- Credited: Chris Gates
- Disclosed: 2020-03-13
- Write-up quality: 6/10
- Original: http://carnal0wnage.attackresearch.com/2020/03/what-is-your-gcp-infra-worthabout-700.html
- Library page: https://bugbountylibrary.com/r/blog%3Acarnal0wnage-attackresearch-com-2020-03-what-is-your-gcp-infra-worthabout-700-html
- Tags: domain:cloud impact:data-leak impact:internal-access kind:bounty platform:blog sev:critical tech:gcp technique:recon vuln:misconfiguration vuln:secrets-leak

**Target:** Internet-exposed Jupyter Notebook server on GCP compute host
**Root cause:** Jupyter Notebook was exposed without authentication, and a GCP service account key was left in a notebook folder (base64-encoded) and echoed in notebook error output.
**Steps:**
1. Find open Jupyter notebook via Shodan search for exposed instances
2. Access the notebook server unauthenticated and open its terminal
3. Locate service account key file in a folder; base64-decode it
4. Confirm key also appears in a notebook's error output
5. Authenticate gcloud with the service account key
6. Run `bq ls --format=prettyjson --project_id tokopedia-970` to list BigQuery datasets/tables
7. Use the compute host's installed GCP utils to SSH to other internal hosts from the Jupyter terminal
**How found:** Researcher was trolling Shodan for vulnerable boxes and spotted an open Jupyter notebook; ownership was not obvious until terminal poking and the leaked key/error output identified Tokopedia.
**Exploitation:** Attacker with access to the open notebook uses its terminal to read the leaked service account key, authenticates to GCP with it, enumerates BigQuery billing tables, and pivots via SSH from the compromised compute host to other internal hosts.
**Escalation:** Pivoted from notebook shell to GCP service account access, then to internal host SSH access and BigQuery data exposure.
**Insight:** Exposed Jupyter notebooks often sit on GCP compute hosts with gcloud/bq preinstalled and credentials in notebook folders or error tracebacks; Shodan for open notebook servers and check both filesystem and cell output for keys.