Bad.Build Flaw in Google Cloud Build Raises Concerns of Privilege Escalation

 

 

 

On July 19, 2023, cybersecurity researchers made a concerning discovery regarding a privilege escalation vulnerability in Google Cloud. Termed "Bad.Build," the flaw could potentially allow malicious actors to tamper with application images and infect users, resulting in supply chain attacks.

The vulnerability is found in the Google Cloud Build service and was identified by cloud security firm Orca, which subsequently reported the issue. By exploiting this flaw, attackers can impersonate the default Cloud Build service, granting them the ability to manipulate images in the Google Artifact Registry and inject malicious code. Any applications built from these manipulated images could then be affected. The risk extends beyond the supplying organization's environment, potentially impacting their customers' environments, presenting a significant supply chain risk.

Upon responsible disclosure, Google has issued a partial fix. However, the privilege escalation vector has not been entirely eliminated, with Google classifying it as a low-severity issue. As a result, no further customer action is currently required.

The root of the problem lies in Cloud Build's automatic creation of a default service account to carry out builds on behalf of users' projects. This service account comes with excessive permissions, including access to audit logs containing a complete list of all permissions on the project. This information is valuable to attackers as it facilitates lateral movement and privilege escalation within the environment.

To exploit the vulnerability, a malicious actor can abuse permissions obtained through other means to impersonate the Google Cloud Build service account and gain elevated privileges. They can then exfiltrate an image used in Google Kubernetes Engine (GKE) and alter it to incorporate malware. Once the malicious image is deployed, the attacker can run code on the docker container as root, potentially leading to severe consequences.

 

Google's patch focuses on revoking the "logging.privateLogEntries.list" permission from the Cloud Build service account, thereby preventing default access to enumerate private logs.

It's worth noting that this is not the first time privilege escalation flaws impacting the Google Cloud Platform have been reported. In 2020, various techniques were detailed by Gitlab, Rhino Security Labs, and Praetorian that could be exploited to compromise cloud environments.

To mitigate possible risks, customers are advised to monitor the behavior of the default Google Cloud Build service account for any potential malicious activity and apply the principle of least privilege (PoLP) to limit unnecessary access and privileges.