Bad.Build Flaw in Google Cloud Build Raises Concerns of Privilege Escalation
On July 19, 2023, cybersecurity researchers made a concerning discovery regarding a privilege escalation vulnerability in Google Cloud. Termed "Bad.Build," the flaw could potentially allow malicious actors to tamper with application images and infect users, resulting in supply chain attacks. The vulnerability is found in the Google Cloud Build service and was identified by cloud security firm Orca, which subsequently reported the issue. By exploiting this flaw, attackers can impersonate the default Cloud Build service, granting them the ability to manipulate images in the Google Artifact Registry and inject malicious code. Any applications built from these manipulated images could then be affected. The risk extends beyond the supplying organization's environment, potentially impacting their customers' environments, presenting a significant supply chain risk. Upon responsible disclosure, Google has issued a partial fix. However, the privilege escalation vector ha...