{"id":52894,"date":"2023-07-24T04:08:27","date_gmt":"2023-07-24T04:08:27","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/google-half-patches-cloud-build-permissions-exploit-the-rest-is-on-you\/"},"modified":"2023-07-24T04:08:27","modified_gmt":"2023-07-24T04:08:27","slug":"google-half-patches-cloud-build-permissions-exploit-the-rest-is-on-you","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/google-half-patches-cloud-build-permissions-exploit-the-rest-is-on-you\/","title":{"rendered":"Google half-patches Cloud Build permissions exploit, the rest is on you"},"content":{"rendered":"

Infosec in brief<\/span> A security weakness in Google Cloud Build could have allowed attackers to tamper with organizations’ code repositories and application images, according to Orca Security researchers.<\/p>\n

The firm’s Research Pod today published details about a “critical” flaw, and warned that it could have been exploited to achieve a supply-chain attack along the lines of SolarWinds \u2013 or, more recently, MOVEit \u2013 with “far reaching consequences.”<\/p>\n

After word of the vulnerability reached the Chocolate Factory, Google deployed a fix \u2013 though it doesn’t fully address the issue, according to Orca researcher Roi Nisimi. <\/p>\n