A critical design flaw in the Google Cloud Build service discovered by cloud security firm Orca Security can let attackers escalate privileges, providing them with almost nearly-full and unauthorized access to Google Artifact Registry code repositories.
Dubbed
Bad.Build, this flaw could enable the threat actors to impersonate the service account for the Google Cloud Build managed continuous integration and delivery (CI/CD) service to run API calls against the artifact registry and take control over application images.
This allows them to inject malicious code, resulting in vulnerable applications and potential supply chain attacks after deploying the malicious applications within customers' environments.
"The potential impact can be diverse, and applies to all organizations that are using the Artifact Registry as their main or secondary image repository,"
said Orca security researcher Roi Nisimi.
"The first and immediate impact is disrupting the applications relying on these images. This can lead to DOS, data theft and spreading malware to users.
"As we have seen with the SolarWinds and recent 3CX and MOVEit supply chain attacks, this can have far reaching consequences."
The same vulnerability was observed and reported by Rhino Security Lab
here. Still, their method to exploit this privilege escalation flaw was more complex, involving the use of the GCP API and exfiltrated Cloud Build Service Account access tokens.
Orca Security's attack takes advantage of the cloudbuild.builds.create permission to escalate privileges and allow attackers to tamper with Google Kubernetes Engine (GKE) docker images using artifactregistry permissions and run code inside the docker container as root.
