SC Media reports that millions of Google Cloud Platform implementations could have been remotely breached through the exploitation of the now-addressed CloudImposer vulnerability, which could allow unauthorized code execution.
Attacks leveraging the flaw, which stems from a dependency confusion error in GCP, could facilitate the establishment of several compromised cloud instances that would enable supply chain intrusions, according to a Tenable Research report. Moreover, Google's guidance for the flaw was found by Tenable to contain instructions on installing private packages in the impacted services, such as GCP's Cloud Composer, App Engine, and Cloud Function services, which could allow compromise.
"This research shows that although the dependency confusion attack technique was discovered several years ago, there's a surprising and concerning lack of awareness about it and about how to prevent it even among leading tech vendors like Google," said Tenable researcher Liv Matan.
