# Remote code execution in Managed Anthos Service Mesh control plane

Malicious kubeconfig exec credential plugin in istio-system secret executed by managed ASM control plane, yielding RCE and P4SA token theft.

- Payout: $6,000
- Severity: high
- Program: Google
- Credited: Anthony Weems
- Disclosed: 2021-10-15
- Write-up quality: 9/10
- Original: https://lf.lc/vrp/203177829/
- Library page: https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-203177829
- Tags: domain:cloud domain:web3 impact:privesc impact:rce kind:bounty platform:blog sev:high tech:gcp tech:kubernetes technique:chained technique:source-review vuln:rce

**Target:** Istio control plane (managed ASM) multicluster kubeconfig secret handling
**Root cause:** Istio's multicluster secret loader honors kubeconfig exec credential plugins, executing arbitrary commands from a user-controlled secret; managed ASM monitors user clusters for these secrets and runs the plugin in its own control plane.
**Steps:**
1. Create kubeconfig with `users[].user.exec.command: /bin/sh` and `args: ['-c', '<cmd>']`
2. Deploy it as a secret in `istio-system` labeled `istio/multiCluster=true`
3. Control plane reads secret and executes the exec plugin command
4. Only openssl available in managed image; use `openssl req -set_serial <bigint>` to write DER cert to /tmp/engine.enc
5. Craft serial so that AES-128-CBC decrypt with chosen IV yields ELF shared object; `openssl enc -d -aes-128-cbc -K 000...0 -iv <iv> -in /tmp/engine.enc -out /tmp/engine.so`
6. `openssl req -engine /tmp/engine.so exploit` to dlopen and run the engine
7. Engine reaches metadata service and exfiltrates P4SA token
**How found:** Noticed Istio multicluster secrets support kubeconfig exec credential plugins; realized managed ASM still watches user clusters for these secrets and executes plugins in its own control plane, then worked around the minimal container image by abusing openssl req/enc/engine.
**Exploitation:** Attacker with cluster access deploys three staged secrets; managed ASM control plane (running in Google project on Cloud Run) executes the exec plugin, which uses openssl req/enc to write and dlopen a malicious engine shared object, achieving RCE and querying the metadata server for the meshcontrolplane P4SA token.
**Escalation:** Chained kubeconfig exec plugin -> arbitrary command in control plane -> openssl-only file write via DER serial + CBC trick -> dlopen engine -> metadata service token theft for P4SA.
**Insight:** Managed control planes that consume user-cluster secrets inherit client-go exec plugin behavior; check whether managed services still honor kubeconfig auth providers, and when only openssl exists, `req -set_serial` + `enc -d` CBC lets you write arbitrary bytes (ELF) to disk for `-engine` dlopen.