Go With the Flow: Taking a Shadow Dependency in GCP Dataflow Cross Tenant

Varonis Threat Labs uncovered a cross-tenant Google Cloud Dataflow vulnerability that potentially allowed attackers to exploit predictable bucket names and achieve remote code execution (RCE) on another organization’s Dataflow workers, without any access to the victim’s project. Under the right conditions, the attack started from just the target’s GCP project ID. After our Dataflow Rider research , we examined Apache Beam , the open-source SDK behind Dataflow, and found that under certain conditions, attackers could run code in projects they could not access directly.