Add Challenge 62: MCP privilege escalation via Google Service Account on Google Drive by Copilot · Pull Request #2464 · OWASP/wrongsecrets

Copilot · 2026-03-22T06:37:05Z

Adds a new AI-category challenge demonstrating that an MCP server configured with an overly-privileged Google Service Account allows callers to read Google Drive documents they are not directly authorized to access — a real-world privilege escalation pattern seen widely in agent/MCP deployments.

Challenge design

MCP endpoint at /mcp62 exposes a single read_google_drive_document tool
Tool authenticates to Google Drive using a service account (GOOGLE_SERVICE_ACCOUNT_KEY, base64-encoded JSON key) and returns the document's plain-text content
The document content is the secret; answer is validated against WRONGSECRETS_MCP_GOOGLEDRIVE_SECRET
Gracefully degrades to a placeholder message when credentials are unconfigured

New env vars (all defaulted in `application.properties`)

Variable	Purpose
`GOOGLE_SERVICE_ACCOUNT_KEY`	Base64-encoded service account JSON key
`GOOGLE_DRIVE_DOCUMENT_ID`	Document to read (defaults to OWASP doc)
`WRONGSECRETS_MCP_GOOGLEDRIVE_SECRET`	Expected answer stored in the document

Implementation notes

Uses ServiceAccountCredentials from google-auth-library-oauth2-http (already a transitive dep via google-cloud-secretmanager) — no new dependencies added
Validates service account JSON structure before use to guard against malformed input
@Autowired on the primary constructor disambiguates Spring injection from the package-private test constructor

Operator setup

docs/CHALLENGE62_GOOGLE_DRIVE_SETUP.md covers end-to-end: create GCP project → enable Drive API → create service account → share document → encode key → configure env vars.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

checkstyle.org
- Triggering command: /opt/hostedtoolcache/CodeQL/2.24.3/x64/codeql/tools/linux64/java/bin/java /opt/hostedtoolcache/CodeQL/2.24.3/x64/codeql/tools/linux64/java/bin/java -jar /opt/hostedtoolcache/CodeQL/2.24.3/x64/codeql/xml/tools/xml-extractor.jar --fileList=/tmp/codeql-scratch-54b93b06a133b0d9/dbs/java/working/files-to-index3796442728103403313.list --sourceArchiveDir=/tmp/codeql-scratch-54b93b06a133b0d9/dbs/java/src --outputDir=/tmp/codeql-scratch-54b93b06a133b0d9/dbs/java/trap/java --global nfig/composer/ve/home/REDACTED/work/wrongsecrets/wrongsecrets/src/test/java/org/owasp/wrongsecretsc21324bbeaa5380a50a9b7265f9930c251045693:src/main/resources/explanations/challenge62_hint.adoc credential.userngit (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

This section details on the original issue you should resolve

<issue_title>Use MCP server Google Service Account, configured as env-var to obtain document secret</issue_title>
<issue_description>### Context

What should the challenge scenario be like?
You want to get access to a secret document in google drive you are not authorized to (e.g. as default https://docs.google.com/document/d/1vfHmi5lGoHogcjD0wxClZAjDy_qml_i2BtVrjVaklHc/edit?tab=t.0, which is a document in the OWASP Google Drive). But the MCP should use a service-account which allows you with a method to obtain the contents of the document.

What should the participant learn from completing the challenge?
That an MCP should not have a more powerful service account than the caller (Agent/user) in order not to allow for escalating privileges.

For what category would the challenge be? (e.g. Docker, K8s, binary)
AI

Did you encounter this in real life? Could you tell us more about the scenario?

All the times: we see many MCPs created by people that allow for escalating privileges

</issue_description>

<agent_instructions>Please note: you have to scaffold the service-account credential access as well, but those will be provisioned separately later as env-vars. You have to update the readme as well and make sure a user can setup his own service account in his own organization and how the user can then configure wrongsecrets to use that.</agent_instructions>

Comments on the Issue (you are @copilot in this section)

Fixes New challenge: Use MCP server Google Service Account, configured as env-var to obtain document secret #2463

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

commjoen · 2026-03-22T06:41:01Z

@copilot correction: please use https://docs.google.com/document/d/1PlZkwEd7GouyY4cdOxBuczm6XumQeuZN31LR2BXRgPs/edit?tab=t.0 instead as a default

…rive privilege escalation Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com> Agent-Logs-Url: https://github.com/OWASP/wrongsecrets/sessions/aea8cbf2-d8ec-451d-a4e1-60d1f9d7bd0c

…umQeuZN31LR2BXRgPs Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com> Agent-Logs-Url: https://github.com/OWASP/wrongsecrets/sessions/665c620f-7247-4cc7-abf4-0c43187beabb

Copilot · 2026-03-22T06:57:30Z

@copilot correction: please use https://docs.google.com/document/d/1PlZkwEd7GouyY4cdOxBuczm6XumQeuZN31LR2BXRgPs/edit?tab=t.0 instead as a default

Updated in commit 2572651 — the default GOOGLE_DRIVE_DOCUMENT_ID is now 1PlZkwEd7GouyY4cdOxBuczm6XumQeuZN31LR2BXRgPs in the controller, application.properties, test, and setup docs.

github-actions · 2026-03-22T07:02:46Z

🌐 GitHub Pages Preview Ready!

Your static preview is now available at:
🔗 Preview PR #2464

📄 What's included:

✅ All CSS, JavaScript, and static assets (embedded inline)
✅ Current styling and layout preview
✅ Images, icons, and UI components
✅ NEW: Generated HTML from Thymeleaf templates
- 🏠 Home/Welcome Page
- ℹ️ About Page
- 📊 Stats & Config Page
- 🤖 Challenge 57: LLM Security (Latest)
- 🧩 Challenge Example

For full functionality testing: Use the Docker preview instead.

🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR.

_{Static preview with Thymeleaf generation by GitHub Actions}

github-actions · 2026-03-22T07:08:42Z

🔨 Preview Build Complete!

Your changes have been built and pushed to GitHub Container Registry.

🐳 Docker Image: ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2464-c0d2e76

📦 Download & Test Locally:

📁 Download Docker Image Artifact (look for wrongsecrets-preview-pr-2464)
Load and run the image:

# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 -p 8090:8090 wrongsecrets-preview

🚀 Alternative - Pull from Registry:

docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2464-c0d2e76
docker run -p 8080:8080 -p 8090:8090 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2464-c0d2e76

Then visit: http://localhost:8080

📝 Changes in this PR:
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge62.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge62McpController.java
- src/main/resources/explanations/challenge62.adoc
- src/main/resources/explanations/challenge62_hint.adoc
- src/main/resources/explanations/challenge62_reason.adoc

Visual diff screenshots will be available shortly...

_{Preview built by GitHub Actions}

github-actions · 2026-03-22T07:12:31Z

📸 Visual Diff Ready!

Screenshots comparing your changes with the main branch are available:

📁 Download Visual Diff Artifacts

🖼️ Included screenshots:

pr-home.png vs main-home.png - Welcome page comparison
pr-about.png vs main-about.png - About page comparison
pr-challenge.png vs main-challenge.png - Challenge page comparison

🔍 How to review:

Download the artifact zip file
Extract and compare the pr-* and main-* images side by side
Look for visual differences in layout, styling, and content

💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily.

_{Visual diff generated by GitHub Actions • PR #2464}

commjoen · 2026-03-22T07:56:58Z

@copilot can you fix the failing github actions please?

Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com> Agent-Logs-Url: https://github.com/OWASP/wrongsecrets/sessions/66a69803-a342-410a-aaca-8256c95ff9f9

Copilot · 2026-03-22T08:00:15Z

@copilot can you fix the failing github actions please?

Fixed in commit 68de73e. There were two issues:

Spotless (Google Java Format) violations in Challenge62McpController.java and Challenge62McpControllerTest.java — ran mvn spotless:apply to auto-fix formatting (constructor call line length, unused imports).
Dead Link Checker failure — the Google Docs URL always returns 401 to automated checkers since it requires authentication. Added https://docs.google.com/document/* to .lycheeignore.

The CODE_OF_CONDUCT.md link failure (contributor-covenant.org/faq) is a pre-existing network error unrelated to this PR.

github-actions · 2026-03-22T08:11:16Z

🌐 GitHub Pages Preview Ready!

Your static preview is now available at:
🔗 Preview PR #2464

📄 What's included:

✅ All CSS, JavaScript, and static assets (embedded inline)
✅ Current styling and layout preview
✅ Images, icons, and UI components
✅ NEW: Generated HTML from Thymeleaf templates
- 🏠 Home/Welcome Page
- ℹ️ About Page
- 📊 Stats & Config Page
- 🤖 Challenge 57: LLM Security (Latest)
- 🧩 Challenge Example

For full functionality testing: Use the Docker preview instead.

🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR.

_{Static preview with Thymeleaf generation by GitHub Actions}

github-actions · 2026-03-22T08:16:44Z

🔨 Preview Build Complete!

Your changes have been built and pushed to GitHub Container Registry.

🐳 Docker Image: ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2464-1273332

📦 Download & Test Locally:

📁 Download Docker Image Artifact (look for wrongsecrets-preview-pr-2464)
Load and run the image:

# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 -p 8090:8090 wrongsecrets-preview

🚀 Alternative - Pull from Registry:

docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2464-1273332
docker run -p 8080:8080 -p 8090:8090 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2464-1273332

Then visit: http://localhost:8080

📝 Changes in this PR:
- src/main/java/org/owasp/wrongsecrets/SecurityConfig.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge62.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge62McpController.java
- src/main/resources/explanations/challenge62.adoc
- src/main/resources/explanations/challenge62_hint.adoc
- src/main/resources/explanations/challenge62_reason.adoc

Visual diff screenshots will be available shortly...

_{Preview built by GitHub Actions}

github-actions · 2026-03-22T08:19:56Z

📸 Visual Diff Ready!

Screenshots comparing your changes with the main branch are available:

📁 Download Visual Diff Artifacts

🖼️ Included screenshots:

pr-home.png vs main-home.png - Welcome page comparison
pr-about.png vs main-about.png - About page comparison
pr-challenge.png vs main-challenge.png - Challenge page comparison

🔍 How to review:

Download the artifact zip file
Extract and compare the pr-* and main-* images side by side
Look for visual differences in layout, styling, and content

💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily.

_{Visual diff generated by GitHub Actions • PR #2464}

github-actions · 2026-03-22T11:59:31Z

🌐 GitHub Pages Preview Ready!

Your static preview is now available at:
🔗 Preview PR #2464

📄 What's included:

✅ All CSS, JavaScript, and static assets (embedded inline)
✅ Current styling and layout preview
✅ Images, icons, and UI components
✅ NEW: Generated HTML from Thymeleaf templates
- 🏠 Home/Welcome Page
- ℹ️ About Page
- 📊 Stats & Config Page
- 🤖 Challenge 57: LLM Security (Latest)
- 🧩 Challenge Example

For full functionality testing: Use the Docker preview instead.

🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR.

_{Static preview with Thymeleaf generation by GitHub Actions}

github-actions · 2026-03-22T12:05:58Z

🔨 Preview Build Complete!

Your changes have been built and pushed to GitHub Container Registry.

🐳 Docker Image: ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2464-1746c41

📦 Download & Test Locally:

📁 Download Docker Image Artifact (look for wrongsecrets-preview-pr-2464)
Load and run the image:

# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 -p 8090:8090 wrongsecrets-preview

🚀 Alternative - Pull from Registry:

docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2464-1746c41
docker run -p 8080:8080 -p 8090:8090 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2464-1746c41

Then visit: http://localhost:8080

📝 Changes in this PR:
- src/main/java/org/owasp/wrongsecrets/SecurityConfig.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge62.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge62McpController.java
- src/main/resources/explanations/challenge62.adoc
- src/main/resources/explanations/challenge62_hint.adoc
- src/main/resources/explanations/challenge62_reason.adoc

Visual diff screenshots will be available shortly...

_{Preview built by GitHub Actions}

github-actions · 2026-03-22T12:09:19Z

📸 Visual Diff Ready!

Screenshots comparing your changes with the main branch are available:

📁 Download Visual Diff Artifacts

🖼️ Included screenshots:

pr-home.png vs main-home.png - Welcome page comparison
pr-about.png vs main-about.png - About page comparison
pr-challenge.png vs main-challenge.png - Challenge page comparison

🔍 How to review:

Download the artifact zip file
Extract and compare the pr-* and main-* images side by side
Look for visual differences in layout, styling, and content

💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily.

_{Visual diff generated by GitHub Actions • PR #2464}

github-actions · 2026-03-22T21:21:17Z

🌐 GitHub Pages Preview Ready!

Your static preview is now available at:
🔗 Preview PR #2464

📄 What's included:

✅ All CSS, JavaScript, and static assets (embedded inline)
✅ Current styling and layout preview
✅ Images, icons, and UI components
✅ NEW: Generated HTML from Thymeleaf templates
- 🏠 Home/Welcome Page
- ℹ️ About Page
- 📊 Stats & Config Page
- 🤖 Challenge 57: LLM Security (Latest)
- 🧩 Challenge Example

For full functionality testing: Use the Docker preview instead.

🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR.

_{Static preview with Thymeleaf generation by GitHub Actions}

github-actions · 2026-03-22T21:26:49Z

🔨 Preview Build Complete!

Your changes have been built and pushed to GitHub Container Registry.

🐳 Docker Image: ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2464-923326e

📦 Download & Test Locally:

📁 Download Docker Image Artifact (look for wrongsecrets-preview-pr-2464)
Load and run the image:

# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 -p 8090:8090 wrongsecrets-preview

🚀 Alternative - Pull from Registry:

docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2464-923326e
docker run -p 8080:8080 -p 8090:8090 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2464-923326e

Then visit: http://localhost:8080

📝 Changes in this PR:
- src/main/java/org/owasp/wrongsecrets/SecurityConfig.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge62.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge62McpController.java
- src/main/resources/explanations/challenge62.adoc
- src/main/resources/explanations/challenge62_hint.adoc
- src/main/resources/explanations/challenge62_reason.adoc

Visual diff screenshots will be available shortly...

_{Preview built by GitHub Actions}

github-actions · 2026-03-22T21:29:57Z

📸 Visual Diff Ready!

Screenshots comparing your changes with the main branch are available:

📁 Download Visual Diff Artifacts

🖼️ Included screenshots:

pr-home.png vs main-home.png - Welcome page comparison
pr-about.png vs main-about.png - About page comparison
pr-challenge.png vs main-challenge.png - Challenge page comparison

🔍 How to review:

Download the artifact zip file
Extract and compare the pr-* and main-* images side by side
Look for visual differences in layout, styling, and content

💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily.

_{Visual diff generated by GitHub Actions • PR #2464}

…ing a better setup

github-actions · 2026-03-23T06:21:49Z

🌐 GitHub Pages Preview Ready!

Your static preview is now available at:
🔗 Preview PR #2464

📄 What's included:

✅ All CSS, JavaScript, and static assets (embedded inline)
✅ Current styling and layout preview
✅ Images, icons, and UI components
✅ NEW: Generated HTML from Thymeleaf templates
- 🏠 Home/Welcome Page
- ℹ️ About Page
- 📊 Stats & Config Page
- 🤖 Challenge 57: LLM Security (Latest)
- 🧩 Challenge Example

For full functionality testing: Use the Docker preview instead.

🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR.

_{Static preview with Thymeleaf generation by GitHub Actions}

github-actions · 2026-03-23T06:28:09Z

🔨 Preview Build Complete!

Your changes have been built and pushed to GitHub Container Registry.

🐳 Docker Image: ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2464-cdc66ff

📦 Download & Test Locally:

📁 Download Docker Image Artifact (look for wrongsecrets-preview-pr-2464)
Load and run the image:

# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 -p 8090:8090 wrongsecrets-preview

🚀 Alternative - Pull from Registry:

docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2464-cdc66ff
docker run -p 8080:8080 -p 8090:8090 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2464-cdc66ff

Then visit: http://localhost:8080

📝 Changes in this PR:
- src/main/java/org/owasp/wrongsecrets/SecurityConfig.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge60McpController.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge62.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge62McpController.java
- src/main/resources/explanations/challenge62.adoc
- src/main/resources/explanations/challenge62_hint.adoc
- src/main/resources/explanations/challenge62_reason.adoc

Visual diff screenshots will be available shortly...

_{Preview built by GitHub Actions}

github-actions · 2026-03-23T06:31:15Z

📸 Visual Diff Ready!

Screenshots comparing your changes with the main branch are available:

📁 Download Visual Diff Artifacts

🖼️ Included screenshots:

pr-home.png vs main-home.png - Welcome page comparison
pr-about.png vs main-about.png - About page comparison
pr-challenge.png vs main-challenge.png - Challenge page comparison

🔍 How to review:

Download the artifact zip file
Extract and compare the pr-* and main-* images side by side
Look for visual differences in layout, styling, and content

💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily.

_{Visual diff generated by GitHub Actions • PR #2464}

github-actions · 2026-03-23T06:49:34Z

🌐 GitHub Pages Preview Ready!

Your static preview is now available at:
🔗 Preview PR #2464

📄 What's included:

✅ All CSS, JavaScript, and static assets (embedded inline)
✅ Current styling and layout preview
✅ Images, icons, and UI components
✅ NEW: Generated HTML from Thymeleaf templates
- 🏠 Home/Welcome Page
- ℹ️ About Page
- 📊 Stats & Config Page
- 🤖 Challenge 57: LLM Security (Latest)
- 🧩 Challenge Example

For full functionality testing: Use the Docker preview instead.

🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR.

_{Static preview with Thymeleaf generation by GitHub Actions}

github-actions · 2026-03-23T06:54:43Z

📸 Visual Diff Available!

Screenshots have been generated comparing your changes with the main branch.

Download Visual Diff Artifacts

The artifacts contain:

pr-home.png - Your version of the home page
main-home.png - Current main branch home page
pr-about.png - Your version of the about page
main-about.png - Current main branch about page

Compare these images to see the visual impact of your changes!

_{Visual diff generated by GitHub Actions}

github-actions · 2026-03-23T06:57:10Z

🔨 Preview Build Complete!

Your changes have been built and pushed to GitHub Container Registry.

🐳 Docker Image: ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2464-f357631

📦 Download & Test Locally:

📁 Download Docker Image Artifact (look for wrongsecrets-preview-pr-2464)
Load and run the image:

# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 -p 8090:8090 wrongsecrets-preview

🚀 Alternative - Pull from Registry:

docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2464-f357631
docker run -p 8080:8080 -p 8090:8090 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2464-f357631

Then visit: http://localhost:8080

📝 Changes in this PR:
- src/main/java/org/owasp/wrongsecrets/SecurityConfig.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge60McpController.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge62.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge62McpController.java
- src/main/resources/explanations/challenge62.adoc
- src/main/resources/explanations/challenge62_hint.adoc
- src/main/resources/explanations/challenge62_reason.adoc
- src/main/resources/templates/about.html

Visual diff screenshots will be available shortly...

_{Preview built by GitHub Actions}

github-actions · 2026-03-23T07:00:28Z

📸 Visual Diff Ready!

Screenshots comparing your changes with the main branch are available:

📁 Download Visual Diff Artifacts

🖼️ Included screenshots:

pr-home.png vs main-home.png - Welcome page comparison
pr-about.png vs main-about.png - About page comparison
pr-challenge.png vs main-challenge.png - Challenge page comparison

🔍 How to review:

Download the artifact zip file
Extract and compare the pr-* and main-* images side by side
Look for visual differences in layout, styling, and content

💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily.

_{Visual diff generated by GitHub Actions • PR #2464}

bendehaan

Awesome, let's go!

Initial plan

ed4e2dd

Copilot AI assigned Copilot and commjoen Mar 22, 2026

Copilot started work on behalf of commjoen March 22, 2026 06:37 View session

Add Challenge 62: MCP server with Google Service Account for Google D…

adf3e7e

…rive privilege escalation Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com> Agent-Logs-Url: https://github.com/OWASP/wrongsecrets/sessions/aea8cbf2-d8ec-451d-a4e1-60d1f9d7bd0c

Copilot AI changed the title ~~[WIP] Add MCP server configuration for Google Service Account~~ Add Challenge 62: MCP privilege escalation via Google Service Account on Google Drive Mar 22, 2026

Copilot AI requested a review from commjoen March 22, 2026 06:54

Copilot finished work on behalf of commjoen March 22, 2026 06:54

Copilot started work on behalf of commjoen March 22, 2026 06:54 View session

Update default Google Drive document ID to 1PlZkwEd7GouyY4cdOxBuczm6X…

2572651

…umQeuZN31LR2BXRgPs Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com> Agent-Logs-Url: https://github.com/OWASP/wrongsecrets/sessions/665c620f-7247-4cc7-abf4-0c43187beabb

Copilot finished work on behalf of commjoen March 22, 2026 06:58

Copilot AI temporarily deployed to github-pages March 22, 2026 07:01 Inactive

Copilot started work on behalf of commjoen March 22, 2026 07:57 View session

Fix spotless formatting violations and add Google Docs to lycheeignore

68de73e

Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com> Agent-Logs-Url: https://github.com/OWASP/wrongsecrets/sessions/66a69803-a342-410a-aaca-8256c95ff9f9

Copilot finished work on behalf of commjoen March 22, 2026 08:00

fixes for ui and more

83da4a3

commjoen temporarily deployed to github-pages March 22, 2026 08:10 — with GitHub Actions Inactive

commjoen marked this pull request as ready for review March 22, 2026 08:12

commjoen requested a review from bendehaan as a code owner March 22, 2026 08:12

Merge branch 'master' into copilot/use-mcp-server-google-service-account

55f6707

commjoen temporarily deployed to github-pages March 22, 2026 11:58 — with GitHub Actions Inactive

Fix of snippet for better layoutting

9617f3e

commjoen temporarily deployed to github-pages March 22, 2026 21:20 — with GitHub Actions Inactive

commjoen added 2 commits March 23, 2026 07:00

Update to challenge62: optimize for extra preloading of docs, and hav…

5d40758

…ing a better setup

final fixes for challenge62 including docs

e4f6bbd

commjoen temporarily deployed to github-pages March 23, 2026 06:20 — with GitHub Actions Inactive

commjoen added 2 commits March 23, 2026 07:47

Pre-release of 1.13.2

b0a0945

update pom

8967c75

commjoen deployed to github-pages March 23, 2026 06:48 — with GitHub Actions View deployment

bendehaan approved these changes Mar 23, 2026

View reviewed changes

commjoen merged commit dac9b45 into master Mar 23, 2026
23 checks passed

commjoen deleted the copilot/use-mcp-server-google-service-account branch March 23, 2026 14:54

Uh oh!

Conversation

Copilot AI commented Mar 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Challenge design

New env vars (all defaulted in application.properties)

Implementation notes

Operator setup

I tried to connect to the following addresses, but was blocked by firewall rules:

Did you encounter this in real life? Could you tell us more about the scenario?

Comments on the Issue (you are @copilot in this section)

Uh oh!

commjoen commented Mar 22, 2026

Uh oh!

Copilot AI commented Mar 22, 2026

Uh oh!

github-actions bot commented Mar 22, 2026

Uh oh!

github-actions bot commented Mar 22, 2026

Uh oh!

github-actions bot commented Mar 22, 2026

Uh oh!

commjoen commented Mar 22, 2026

Uh oh!

Copilot AI commented Mar 22, 2026

Uh oh!

github-actions bot commented Mar 22, 2026

Uh oh!

github-actions bot commented Mar 22, 2026

Uh oh!

github-actions bot commented Mar 22, 2026

Uh oh!

github-actions bot commented Mar 22, 2026

Uh oh!

github-actions bot commented Mar 22, 2026

Uh oh!

github-actions bot commented Mar 22, 2026

Uh oh!

github-actions bot commented Mar 22, 2026

Uh oh!

github-actions bot commented Mar 22, 2026

Uh oh!

github-actions bot commented Mar 22, 2026

Uh oh!

github-actions bot commented Mar 23, 2026

Uh oh!

github-actions bot commented Mar 23, 2026

Uh oh!

github-actions bot commented Mar 23, 2026

Uh oh!

github-actions bot commented Mar 23, 2026

Uh oh!

github-actions bot commented Mar 23, 2026

Uh oh!

github-actions bot commented Mar 23, 2026

Uh oh!

github-actions bot commented Mar 23, 2026

Uh oh!

bendehaan left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Mar 22, 2026 •

edited

Loading

New env vars (all defaulted in `application.properties`)