Topic

Confused Deputy Problem

A class of authorization flaw in which a privileged component carries out instructions from a less privileged caller without checking whether that caller was entitled to the result.

Current clusters

security1 publisher

Config Connector turns namespace write access into roles/owner on a GCP organization

Justin O'Leary's ConfigConfusion technique turns on the fact that Google's Config Connector makes every cloud call with its own service account, so a tenant who can create one IAMPolicyMember inherits whatever that account is allowed to grant.

Publishers:bleepingcomputer.com

Reality

Evidence50
Adoption: Insufficient
Hype gap+18
Incentives40
Confidence58