# Cross-tenant Cloud Function compromise via storage bucket squatting

Cloud Functions uploaded source to a predictable gcf-sources bucket without verifying ownership, letting an attacker squat the bucket to read and backdoor victim code.

- Payout: $3,134
- Severity: high
- Program: Google
- Credited: Anthony Weems
- Disclosed: 2020-09-20
- Write-up quality: 8/10
- Original: https://lf.lc/vrp/168991979/
- Library page: https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-168991979
- Tags: domain:cloud impact:data-leak impact:rce kind:bounty platform:blog sev:high tech:gcp technique:chained technique:recon vuln:access-control vuln:misconfiguration

**Target:** Cloud Functions source upload / Cloud Storage bucket
**Root cause:** Backend uploads user code to gcf-sources-<project-id>-<location> bucket without verifying the bucket owner matches the current project, and the name is predictable/registrable.
**Steps:**
1. Know victim numeric project ID and a region with no existing functions.
2. `gsutil mb gs://gcf-sources-928967777810-us-central1`
3. `gsutil iam ch "allUsers:admin" gs://gcf-sources-928967777810-us-central1`
4. Wait for victim to deploy a Cloud Function in that region.
5. Download victim's function-source.zip from the attacker bucket.
6. Replace archive with backdoored version; victim redeploys via UI without noticing.
**How found:** Observed the deterministic gcf-sources-<project-id>-<location> bucket naming and that the name is neither a domain nor contains 'Google', hypothesizing it could be registered by anyone; tested by squatting a bucket and deploying a victim function.
**Exploitation:** Attacker pre-creates the predictable gcf-sources bucket for the victim's project/region and grants allUsers access. On victim deploy, backend uploads source archive to attacker bucket; attacker reads code and swaps in a backdoored archive, yielding a shell when victim redeploys.
**Escalation:** Backdooring the source archive escalates from source disclosure to code execution in victim's function on next UI redeploy.
**Insight:** Predictable, registrable storage bucket names derived from public identifiers (project IDs) are squatting targets; check whether backend writes to a bucket it doesn't own before assuming isolation.