Federated cloud role accepts the wrong workload identity
OIDC role trust accepts a legitimate token from a disallowed controlled subject, repository, branch or audience.
Candidate CWE: CWE-863
Test hypothesis#
Use the owned identity provider's normal token issuance to create allowed and disallowed fixture identities. Attempt the same role exchange and canary operation, changing one claim dimension at a time.
Evidence required#
Redacted issuer/audience/subject claims, trust policy, session role and allowed/denied control. Keep full tokens out of the report.
Rule out false positives#
A token merely decodes successfully, a wildcard covers only the intended trust set, or the provider rejects the exchange before any authority is obtained.
Playbook and command references#
- Cloud IAM: trust, delegation and effective permissions — Prove which principal can act on which resource, including cross-account trust, delegated roles and workload federation.
- Azure and GCP: identity, delegation and storage access — Apply provider-specific controls for Azure management/data permissions and SAS, plus GCP service accounts, federation and object ACLs.
Find the associated command snippets
Referenced by these target playbooks#
Report checklist#
- Capture the affected version, configuration, identities, and object ownership.
- Preserve a valid baseline and a negative control.
- Reproduce the forbidden data access, action, or state change on controlled fixtures.
- Explain the intended security rule and why the observed behavior violates it.
- State prerequisites, uncertainty, cleanup, and the smallest demonstrated impact.
Conditional ATT&CK mapping#
- T1078.004 · Valid Accounts: Cloud Accounts — Only if: A controlled reproduction uses compromised or misused valid cloud credentials/accounts to gain access or exceed the account's intended role; identify the specific observed goal. Not established by: The existence of a cloud account, a suspected leaked key, or authorized use of a researcher account is not enough. The official tactic list does not mean all four goals occurred.