A recent vulnerability unearthed in Gerrit, the open-source code review platform used by Google and other tech giants, has raised concerns about the potential introduction of unauthorized code into critical projects. This flaw, unveiled by Tenable’s security researchers, was rooted in misconfigured permissions and review label logic within Gerrit’s infrastructure.
In certain configurations, a feature known as “addPatchSet” could be exploited by attackers to modify pre-approved changes, allowing malicious code to slip through without triggering the usual re-review process. A report from CybersecurityAsia.net highlighted that attackers could bypass manual reviews and employ automated tools to insert unauthorized code without any user interaction.
At least 18 significant repositories were flagged as vulnerable. These included projects tied to Chromium, Dart, and Bazel, among others. The vulnerability also involved a race condition in the automated submission process, which permitted attackers to act within a brief window before code integration.
Despite these findings, there have been no confirmed cases of the vulnerability being exploited in real-world scenarios. Tenable conducted responsible testing with benign code and refrained from a full-scale exploit attempt.
Following the disclosure, Google has adjusted configurations to address the issue. Tenable advises other Gerrit users to examine their settings, as similar vulnerabilities might exist. They recommend auditing permission rules and label persistence policies to maintain code integrity. This incident highlights the critical need for secure development environments within the open-source community.
