CVE-2025-2903

Executive Summary

CVE-2025-2903 describes a privilege escalation and authentication bypass vulnerability in Google Cloud Platform’s OS Login feature. An attacker who possesses knowledge of user accounts created during VM deployment can authenticate via SSH and gain command-line access to the operating system. This allows the attacker to read sensitive data, install malware, and disrupt VM functionality. The vulnerability is currently unpatched, and no official fix has been released by Google. The attack vector relies on the attacker’s ability to enumerate or predict user accounts created during VM provisioning, combined with the OS Login mechanism’s failure to enforce additional authentication factors.

Supply Chain & Package Security

This vulnerability does not directly affect NPM, PyPI, Go, or Ruby packages. However, any application or service running on a compromised GCP VM could be impacted, including those built with these package ecosystems. Organizations should audit their GCP VM deployments for OS Login usage and ensure that SSH access is restricted to authorized users only.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official CVSS vector assigned)
• Attack Vector (AV): Network (assumed)
• Attack Complexity (AC): Low (assumed)
• Privileges Required (PR): Low (attacker needs knowledge of user accounts)
• User Interaction (UI): None
• Scope (S): Changed (VM compromise can affect other resources)
• Confidentiality (C): High
• Integrity (I): High
• Availability (A): High

Threat Level: Critical (due to potential for full VM compromise with low complexity)

Deep Dive & Mechanics

The OS Login feature in GCP allows users to manage SSH keys and user accounts via IAM roles. When a VM is deployed, user accounts are created based on IAM permissions. The vulnerability arises because the OS Login mechanism does not sufficiently validate the identity of the user attempting to authenticate. An attacker who knows the username of an authorized user (e.g., through enumeration or leaked metadata) can bypass additional authentication checks and gain SSH access.

Attack Flow:

1. Attacker enumerates or obtains a list of user accounts created during VM deployment (e.g., via GCP metadata endpoints or leaked IAM roles).
2. Attacker uses SSH with the known username and a valid SSH key (if key-based authentication is enabled) or exploits weak password policies.
3. OS Login grants access without verifying the attacker’s identity beyond the username.
4. Attacker gains command-line access to the VM.

Root Cause: Insufficient authentication validation in the OS Login service, allowing username-based authentication without proper identity proofing.

Vulnerable vs. Patched Code

No official patch has been released. The vulnerable code resides in the OS Login service’s authentication module. A hypothetical patch would enforce multi-factor authentication (MFA) or require additional IAM role verification before granting SSH access.

Vulnerable Code (Conceptual):

def authenticate_user(username, ssh_key):
    if username in authorized_users:
        return grant_access(username)
    else:
        return deny_access()

Patched Code (Conceptual):

def authenticate_user(username, ssh_key, iam_token):
    if username in authorized_users and verify_iam_token(iam_token):
        return grant_access(username)
    else:
        return deny_access()

Exploitation & Lab Setup

Red Team

Prerequisites:

• Knowledge of a valid username on the target GCP VM.
• SSH client installed.
• Network access to the VM’s external IP.

Exploitation Steps:

1. Enumerate usernames via GCP metadata (e.g., curl http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/).
2. Attempt SSH login with known username:

   ssh known_user@<VM_EXTERNAL_IP>
   

3. If password authentication is enabled, brute-force or use default credentials.
4. Once logged in, execute commands to exfiltrate data or install backdoors.

Example Command:

ssh attacker@35.192.123.45

Blue Team

Detection & Prevention:

• Disable OS Login if not required.
• Enforce SSH key-based authentication only.
• Enable IAP (Identity-Aware Proxy) for SSH access.
• Monitor GCP audit logs for failed SSH attempts.
• Use VPC firewall rules to restrict SSH access to trusted IPs.

Honeypot Setup:

• Deploy a decoy VM with OS Login enabled and monitor for unauthorized SSH attempts.

Indicators of Compromise (IOCs)

• Network: SSH connections from unusual IP addresses to GCP VMs.
• Logs: GCP audit logs showing oslogin authentication events with unknown usernames.
• File System: Presence of unauthorized SSH keys in ~/.ssh/authorized_keys.
• Processes: Unusual processes running under the compromised user account.

Example IOC:

{
  "type": "network",
  "value": "203.0.113.5",
  "description": "Suspicious SSH source IP"
}

Detection Engineering

YARA Rule

rule CVE_2025_2903_OSLogin_Exploit {
    meta:
        description = "Detects exploitation of CVE-2025-2903 via SSH logs"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $ssh_log = /sshd.*Accepted publickey for .* from .* port.*/
        $oslogin_log = /oslogin.*authentication.*success/
    condition:
        $ssh_log and $oslogin_log
}

Sigma Rule

title: CVE-2025-2903 OS Login SSH Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SSH logins via OS Login that may indicate exploitation of CVE-2025-2903
author: Valters IT
date: 2025-04-10
logsource:
    product: gcp
    service: audit
detection:
    selection:
        event_type: "oslogin"
        authentication_result: "success"
    condition: selection
falsepositives:
    - Legitimate OS Login usage
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"CVE-2025-2903 OS Login SSH Exploitation Attempt"; flow:to_server; content:"SSH-2.0-"; depth:6; content:"oslogin"; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable OS Login on all GCP VMs if not required.
2. Enforce SSH key-based authentication and disable password authentication.
3. Use IAP (Identity-Aware Proxy) for SSH access to add an additional authentication layer.
4. Restrict SSH access via VPC firewall rules to trusted IP ranges.

Long-Term Fix:

• Await an official patch from Google. In the meantime, implement compensating controls such as MFA for SSH access.

Workaround:

• Use gcloud compute ssh with IAP tunneling instead of direct SSH.

Valters IT