Raqib v0.8.0

Raqib v0.8.0

Deepens GCP privilege escalation so it reads the documented escalation paths, not just Owner and impersonation, bringing GCP closer to the AWS depth. Both the bash scanner and the Python engine gain the checks and stay in lockstep.

New GCP escalation paths

• Act as a service account to deploy and run as it. The GCP form of passing a role: a member that can act as a service account and create a Cloud Function, a Compute Engine instance, or a Cloud Run service runs with that account permissions. Reported per target, with the generic actAs finding kept as the fallback.
• Rewrite a custom role granted to the member. With iam.roles.update on a role it holds, a member can add permissions to itself.
• Run as a powerful default service account. Starting a Cloud Build build runs as the Cloud Build service account, and creating a Deployment Manager deployment runs as the Google APIs service account, both Editor on the project by default.
• Impersonation broadened. Now also catches signing as a service account and minting OpenID tokens, not only access tokens.

Quality

• New sample principals for each path and six new tests. The parity test still asserts the bash scanner and the Python engine produce the same findings on every sample. 109 tests pass.

Independent tool, not affiliated with or endorsed by any cloud provider. Read only: it lists and describes authorization configuration and never changes anything.