# $7.5k Google Cloud Platform organization issue

Deprecated organizations.update let an attacker rename a GCP organization to impersonate a trusted company, luring users into creating billing accounts and projects inside it.

- Payout: $7,500
- Severity: medium
- Program: Google
- Credited: Ezequiel Pereira
- Disclosed: 2019-01-30
- Write-up quality: 7/10
- Original: https://www.ezequiel.tech/2019/01/75k-google-cloud-platform-organization.html
- Library page: https://bugbountylibrary.com/r/blog%3Aezequiel-tech-2019-01-75k-google-cloud-platform-organization-html
- Tags: domain:cloud impact:integrity impact:internal-access kind:bounty platform:blog sev:medium tech:gcp technique:legacy-endpoint technique:source-review vuln:business-logic vuln:misconfiguration

**Target:** GCP Resource Manager organizations.update API and Cloud Console project-creation flow
**Root cause:** The deprecated organizations.update method allowed modifying the read-only displayName of an organization, and the Console forced users with a single shared org to create projects inside it.
**Steps:**
1. Buy a cheap domain and sign up for G Suite free trial to obtain a GCP organization
2. Call deprecated Resource Manager `organizations.update` to set displayName to `<IMPORTANT-COMPANY>.com` (or 'No organization')
3. Share the organization with `domain:<IMPORTANT-COMPANY>.com` via Cloud IAM
4. Victim with a matching account sees the org in Console; if it is their only org, project creation is forced into it
5. Attacker reopens victim-created billing accounts and accesses projects/resources created in the org
**How found:** Reasoned about how users could be lured into creating resources in an attacker-controlled org; noticed the displayName was documented read-only but still mutable via the deprecated organizations.update method, and that the Console forced single-org users into that org.
**Exploitation:** Attacker registers a lookalike organization name, shares it broadly with a target domain, and waits for victims to create billing accounts or projects inside it; attacker then reopens closed billing accounts and uses resources/credentials created by victims.
**Escalation:** Targeting the internal 'google.com' organization could trick Google employees into creating internal resources in the fake org.
**Insight:** Deprecated API methods often skip validation enforced on newer endpoints; test whether documented read-only fields remain writable via legacy methods, and check UI flows that auto-select a shared resource when only one is available.