# RCE in Google Cloud Deployment Manager

Undocumented dogfood Deployment Manager field googleOptions.transport=GSLB let Type Providers fetch descriptors from internal GSLB endpoints, enabling SSRF into Google internal APIs with possible RCE.

- Payout: $31,337
- Severity: critical
- Program: Google
- Credited: Ezequiel Pereira
- Disclosed: 2020-05-21
- Write-up quality: 9/10
- Original: https://www.ezequiel.tech/2020/05/rce-in-cloud-dm.html
- Library page: https://bugbountylibrary.com/r/blog%3Aezequiel-tech-2020-05-rce-in-cloud-dm-html
- Tags: domain:cloud impact:internal-access impact:rce kind:bounty platform:blog sev:critical tech:gcp technique:reverse-engineering technique:source-review vuln:rce vuln:ssrf

**Target:** Cloud Deployment Manager v2beta/dogfood Type Provider API
**Root cause:** The dogfood API version exposed an undocumented googleOptions field whose transport=GSLB value made Deployment Manager fetch descriptor documents from arbitrary internal GSLB targets, bypassing external-only restrictions.
**Steps:**
1. Enable Deployment Manager API, view Methods filter in Cloud Console metrics to discover alpha and dogfood API versions
2. Replace v2beta with dogfood in API calls; list base types to see extra googleOptions field
3. Use $outputDefaults to enumerate googleOptions subfields (transport, credentialType, gslbTarget, descriptorUrlServerSpec)
4. Switch to Staging with staging_ prefix and use Proto over HTTP (Content-Type: application/x-protobuf) to brute-force enum values via protoc --decode_raw
5. Discover transport=GSLB and credentialType=ENDUSERCREDS/TYPE_CREDENTIAL
6. Create Type Provider with `googleOptions: {transport: GSLB, gslbTarget: 'blade:corp-issuetracker-api', descriptorUrlServerSpec: 'blade:corp-issuetracker-api'}`
7. Poll Operation; on failure read internal endpoint response/stack trace from error; on success call listTypes to enumerate internal API resources
**How found:** Started hunting hidden internal Types and template sandbox escapes (found isolated container). Failed SSRF via issuetracker.corp.googleapis.com and private IPs. Then enumerated API methods via Cloud Console metrics filter, spotted alpha and dogfood versions. Noticed googleOptions field on dogfood base types, guessed GSLB meaning from SRE book, then used Proto over HTTP on Staging to brute-force enum numbers and map fields via protoc --decode_raw.
**Exploitation:** Attacker creates a Type Provider pointing gslbTarget at an internal GSLB name (e.g. blade:apphosting-admin-nightly, blade:corp-issuetracker-api). Deployment Manager issues requests to internal endpoints using its service account, and if credentials are stripped the delegated cloud-dm-staging@prod.google.com identity may be used, granting internal API access potentially leading to RCE.
**Escalation:** Delegation chain: Deployment Manager SA tokens delegated by cloud-dm-staging@prod.google.com; removing SA creds could cause GSLB auth to fall back to the more privileged delegator identity, escalating to internal service access.
**Insight:** Cloud Console metrics 'Methods' dropdown leaks undocumented API versions (alpha, dogfood, staging_ prefix); swapping version strings in REST paths can expose internal-only fields. When JSON enums are strings, switch to Proto over HTTP (application/x-protobuf) on staging to brute-force numeric enum values and reverse the message schema with protoc --decode_raw.