# Remote code execution in import image task via storage bucket squatting

Predictable scratch bucket names in gcloud image import/export let attackers squat buckets and backdoor startup scripts to gain code execution in victim projects.

- Payout: $3,134
- Severity: high
- Program: Google
- Credited: Anthony Weems
- Disclosed: 2020-09-19
- Write-up quality: 8/10
- Original: https://lf.lc/vrp/168987557/
- Library page: https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-168987557
- Tags: domain:cloud impact:internal-access impact:rce kind:bounty platform:blog sev:high tech:gcp technique:race-window technique:recon vuln:misconfiguration vuln:rce

**Target:** gcloud compute images import/export Cloud Build scratch bucket
**Root cause:** The import/export workflow uses a predictable scratch bucket name (<project-id>-daisy-bkt) and writes to it without verifying ownership, so an attacker who pre-creates the bucket controls files the workflow trusts.
**Steps:**
1. Identify victim project ID.
2. Create bucket `gs://<project-id>-daisy-bkt` and grant allUsers storage.buckets.list, storage.objects.get, storage.objects.create.
3. Deploy a Cloud Function triggered on bucket writes that overwrites any `startup_script` or `.sh` object with a backdoor script.
4. Wait for victim to run `gcloud compute images import ...`.
5. Backdoored startup_script executes on the launched instance, giving shell access as <project-id>@cloudbuild.gserviceaccount.com.
**How found:** Noticed the scratch bucket name is derived solely from the project ID and that the workflow writes to it without verifying ownership; realized an attacker could pre-register the name and race the upload.
**Exploitation:** Attacker squats the predictable bucket, grants allUsers access, and uses a Cloud Function on object writes to replace the startup_script uploaded by the victim's import job with a reverse-shell script. When the import instance boots, it runs the attacker's script, yielding control of the Cloud Build service account with devstorage.read_only scope.
**Escalation:** Export variant leaks full exported images; import variant yields code execution as the Cloud Build service account in the victim project.
**Insight:** When a cloud workflow derives a resource name from a guessable identifier (project ID) and writes to it without an ownership check, pre-registering that resource lets you inject into the trusted pipeline; look for predictable bucket/queue/topic names in managed services.