diff --git a/src/privilege-escalation-paths/azure/authorization.yaml b/src/privilege-escalation-paths/azure/authorization.yaml index f4ba149007..463ea15206 100644 --- a/src/privilege-escalation-paths/azure/authorization.yaml +++ b/src/privilege-escalation-paths/azure/authorization.yaml @@ -75,7 +75,7 @@ service: authorization title: Create or update a deployIfNotExists/modify policy assignment running as an existing user-assigned identity source: src/pentesting-cloud/azure-security/az-privilege-escalation/az-authorization-privesc.md#policy-assignment-remediation-with-an-existing-user-assigned-identity - source_revision: 171e422 + source_revision: 4393380a88845b42bd208d3adbb6d61ad89f02fb summary: The source can obtain the Azure RBAC control-plane privileges of user-assigned managed identities on which it holds assign/action, by making them the remediation identity of a policy assignment whose custom definition it controls. requires: all_of: diff --git a/src/privilege-escalation-paths/azure/avs.yaml b/src/privilege-escalation-paths/azure/avs.yaml index 84b58030e8..fc8b8361d8 100644 --- a/src/privilege-escalation-paths/azure/avs.yaml +++ b/src/privilege-escalation-paths/azure/avs.yaml @@ -69,7 +69,7 @@ service: avs title: Gain a named vCenter identity through a verified AVS Run Command grant source: src/pentesting-cloud/azure-security/az-privilege-escalation/az-vmware-solution-avs-privesc.md#run-command-identity-grants-without-reading-credentials-scriptexecutionswrite - source_revision: 171e422 + source_revision: 4393380a88845b42bd208d3adbb6d61ad89f02fb summary: An AVS Run Command cmdlet can grant a named vCenter account new access only when the chosen package and cmdlet succeed and a reviewed login proves the added permission. requires: all_of: diff --git a/src/privilege-escalation-paths/azure/cosmos_db.yaml b/src/privilege-escalation-paths/azure/cosmos_db.yaml index a834a30290..43641ebd16 100644 --- a/src/privilege-escalation-paths/azure/cosmos_db.yaml +++ b/src/privilege-escalation-paths/azure/cosmos_db.yaml @@ -103,7 +103,7 @@ service: cosmos_db title: Grant a Cosmos DB native data-plane role on the Cassandra, Gremlin, Table or MongoDB API source: src/pentesting-cloud/azure-security/az-privilege-escalation/az-cosmosDB-privesc.md#same-native-rbac-self-grant-on-the-other-cosmos-apis-cassandra--gremlin--table--mongodb-account - source_revision: a66f094ede + source_revision: 4393380a88845b42bd208d3adbb6d61ad89f02fb summary: The source may grant its own Entra identity data-plane access on a matching Cosmos DB API account. requires: all_of: [] diff --git a/src/privilege-escalation-paths/azure/entraid_groups.yaml b/src/privilege-escalation-paths/azure/entraid_groups.yaml index eb92d9c701..e8caee55b9 100644 --- a/src/privilege-escalation-paths/azure/entraid_groups.yaml +++ b/src/privilege-escalation-paths/azure/entraid_groups.yaml @@ -145,7 +145,7 @@ service: entraid title: Group owner joins an owned group source: src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/README.md#group-owner-joins-an-owned-group - source_revision: 658a097d5c + source_revision: 4393380a88845b42bd208d3adbb6d61ad89f02fb summary: An enabled owner can join an assigned group it does not already belong to, including a role-assignable group when its protected membership requirements are met. requires: all_of: diff --git a/src/privilege-escalation-paths/gcp/container.yaml b/src/privilege-escalation-paths/gcp/container.yaml index e184a296d8..25851d11b0 100644 --- a/src/privilege-escalation-paths/gcp/container.yaml +++ b/src/privilege-escalation-paths/gcp/container.yaml @@ -356,7 +356,7 @@ service: container title: Point fleet Config Management at an attacker source to push manifests into member clusters source: src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-container-privesc.md#config-management-source-change-for-a-fleet-member - source_revision: 171e422 + source_revision: 4393380a88845b42bd208d3adbb6d61ad89f02fb summary: The source may gain the Config Sync reconciler's privileges on a joined fleet-member cluster when it can change that member's Config Management source through the fleet Feature or MembershipFeature API. requires: any_of: diff --git a/src/privilege-escalation-paths/gcp/workspace.yaml b/src/privilege-escalation-paths/gcp/workspace.yaml index d91d2bc95c..2a0c3f6837 100644 --- a/src/privilege-escalation-paths/gcp/workspace.yaml +++ b/src/privilege-escalation-paths/gcp/workspace.yaml @@ -47,7 +47,7 @@ - https://docs.cloud.google.com/application-integration/docs/prepare-for-authorization-changes notes: The tested draft and published version paths require a collected enabled service and an observed integration in the same project and region. Other regions, new integration creation, and unattended trigger execution remain unresolved if not evidenced. - provider: gcp - source_revision: 47bb6e8f32 + source_revision: 4393380a88845b42bd208d3adbb6d61ad89f02fb id: gcp-agentidentity-retrieve-credentials service: agentidentity title: Retrieve an authorized Google OAuth credential from Agent Identity @@ -77,7 +77,7 @@ - https://docs.cloud.google.com/iam/docs/reference/agentidentitycredentials/rest/v1/projects.locations.authProviders.credentials/retrieve notes: The client user ID is supplied by the client application and is not independently verified as a Workspace identity. The path grants only the scopes on the existing authorization and remains conditional until credential retrieval succeeds. - provider: gcp - source_revision: 47bb6e8f32 + source_revision: 4393380a88845b42bd208d3adbb6d61ad89f02fb id: gcp-agentidentity-update-token-url service: agentidentity title: Change an Agent Identity auth provider's token endpoint to intercept future refreshes