ConfusedFunction Vulnerability Found in Google Cloud Platform - Protect Your Accounts - #ConfusedFunction
A vulnerability dubbed "ConfusedFunction" has been uncovered in Google Cloud Platform's Cloud Functions and Cloud Build services, posing a potential security risk. Discovered by Tenable Research, the flaw stems from the automatic attachment of a default Cloud Build service account with excessive permissions during the deployment of Cloud Functions. This could enable attackers to escalate privileges and gain unauthorized access to other GCP services. While Google has partially addressed the issue for recent instances, existing deployments remain vulnerable. Organizations are advised to review and replace legacy service accounts with least-privileged ones, regularly audit permissions, and implement robust security practices to mitigate potential exploits arising from this vulnerability.