Synopsis
Projects and repositories managed by Google's Gerrit Code Review system allowed for a supply chain attack due to excessive default permissions and a logic flaw in the code review process workflow. For projects with vulnerable configurations in place, attackers could have potentially injected malicious code into trusted build pipelines.
The following projects were found to be vulnerable to this issue. Please note that this list is not comprehensive.
https://ceres-solver-review.googlesource.com/
https://code-review.googlesource.com/
https://cue-review.googlesource.com/
https://dart-review.googlesource.com/
https://opensecura-review.googlesource.com/
https://gn-review.googlesource.com/
https://quiche-review.googlesource.com
https://gerrit-review.googlesource.com/zull/jobs
https://gerrit-review.googlesource.com/gcompute-tools
https://bazel-review.googlesource.com
https://android-kvm-review.googlesource.com/
https://linux-review.googlesource.com/ - also allows code-review +2
https://plan9port-review.googlesource.com/
https://hafnium-review.googlesource.com/
https://nginx-review.googlesource.com/
https://weave-review.googlesource.com/
By default, Gerrit contained a default permission (“addPatchSet”) that allowed any registered user to modify code changes that had already been verified and approved. In addition to this permission, changes submitted via patchsets contained a logic flaw in the patchset approval process that caused new patchsets not to require new code reviews as intended.
By exploiting misconfigurations in permissions and the voting system label handling, attackers could execute malicious code without user interaction, enabling supply chain attacks.
Google changed the label persistence configuration across patch sets in the vulnerable projects to mitigate the issue.
Solution
Google changed the label persistence configuration across patch sets.
Disclosure Timeline
All information within TRA advisories is provided “as is”, without warranty of any kind, including the implied warranties of merchantability and fitness for a particular purpose, and with no guarantee of completeness, accuracy, or timeliness. Individuals and organizations are responsible for assessing the impact of any actual or potential security vulnerability.
Tenable takes product security very seriously. If you believe you have found a vulnerability in one of our products, we ask that you please work with us to quickly resolve it in order to protect customers. Tenable believes in responding quickly to such reports, maintaining communication with researchers, and providing a solution in short order.
For more details on submitting vulnerability information, please see our Vulnerability Reporting Guidelines page.
If you have questions or corrections about this advisory, please email [email protected]
Contact our sales team