A now-patched critical security flaw affecting Google Cloud Platform (GCP) Composer could have been used to achieve remote code execution on cloud servers through a supply chain attack technique known as dependency confusion.
The vulnerability, dubbed CloudImposer by Tenable Research, posed a significant threat to GCP users. "The vulnerability could have allowed an attacker to hijack an internal software dependency that Google pre-installs on each Google Cloud Composer pipeline-orchestration tool," said security researcher Liv Matan in a report shared with The Hacker News.
Dependency confusion, also known as a substitution attack, is a supply chain compromise that tricks a package manager into downloading a malicious package from a public repository instead of the intended internal file. This method was first highlighted by Alex Birsan in February 2021. The attacker can stage a large-scale supply chain attack by publishing a counterfeit package with the same name as an internal package but with a higher version number. The package manager unknowingly fetches the malicious package from the public repository, replacing the legitimate dependency.
Tenable discovered that this type of attack could be exploited on GCP by uploading a malicious package to Python Package Index (PyPI) named "google-cloud-datacatalog-lineage-producer-client," which would then be installed on Composer instances with elevated permissions.
While Cloud Composer version-pins the package at 0.1.0, Tenable researchers found that using the "--extra-index-url" argument during a pip install command prioritizes fetching the package from the public registry, opening the system to dependency confusion.
Attackers could use this flaw to execute code, steal service account credentials, and move laterally across GCP services.
Google addressed the flaw following responsible disclosure in January 2024 and implemented the fix in May 2024. The fix ensures that the package is only installed from a private repository, with an additional safeguard of verifying the package's checksum to confirm its integrity.
The Python Packaging Authority (PyPA) had been aware of risks related to the "--extra-index-url" argument since March 2018, advising users to avoid using PyPI for internal packages.
As part of its fix, Google now recommends using the "--index-url" argument instead, significantly reducing the risk of dependency confusion attacks. Additionally, GCP customers are advised to use Artifact Registry virtual repositories when handling multiple repositories.
