gcp-ar-public-upload-is-code-modify

A repository granting uploadArtifacts to allUsers allows any unauthenticated attacker on the public internet to push code - the most critical supply-chain injection vulnerability.

derived gcp emits CanModifyCode

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`AnonymousIdentity`
target type	`*`
source	`?anon`
target	`?repo`
permissions	`artifactregistry.repositories.uploadArtifacts (granted to allUsers)`
state logic	ACTIVE — no authentication required. Any attacker with internet connectivity can push code directly. BLOCKED only if a VPC-SC perimeter is misconfigured to reject allUsers API calls (rare; most SCPs allow allUsers in the perimeter to prevent breaking legitimate public-consumer scenarios).

source type

AnonymousIdentity

target type

*

source

?anon

target

?repo

permissions

artifactregistry.repositories.uploadArtifacts (granted to allUsers)

state logic

ACTIVE — no authentication required. Any attacker with internet connectivity can push code directly. BLOCKED only if a VPC-SC perimeter is misconfigured to reject allUsers API calls (rare; most SCPs allow allUsers in the perimeter to prevent breaking legitimate public-consumer scenarios).

Narrative

Repository {repo.name} grants artifactregistry.repositories.uploadArtifacts to allUsers (public internet access). Any unauthenticated attacker can push a malicious container image or package directly into this repository, poisoning every workload that pulls from it. This is the highest-severity supply-chain vulnerability in Artifact Registry - immediate remediation required.

Raw rule rules/derived/gcp/artifactregistry.yaml

id: gcp-ar-public-upload-is-code-modify
emits: CanModifyCode
description: "A repository granting uploadArtifacts to allUsers allows any unauthenticated attacker on\
  \ the public internet to push code \u2014 the most critical supply-chain injection vulnerability."
match:
- - anon: null
  - ExposedToInternet
  - repo: null
where:
- ?anon is AnonymousIdentity
- ?repo has a CanModifyCode derivation path via allUsers+uploadArtifacts (from explicit gcp-ar-public-upload
  rule)
emit:
  source_type: AnonymousIdentity
  target_type: '*'
  source: ?anon
  target: ?repo
  permissions:
  - artifactregistry.repositories.uploadArtifacts (granted to allUsers)
  conditions: []
  state_logic: "ACTIVE \u2014 no authentication required. Any attacker with internet connectivity can\
    \ push code directly. BLOCKED only if a VPC-SC perimeter is misconfigured to reject allUsers API calls\
    \ (rare; most SCPs allow allUsers in the perimeter to prevent breaking legitimate public-consumer\
    \ scenarios)."
  confidence: 0.98
  derived_from:
  - 'gcp-ar-public-upload (explicit: allUsers uploadArtifacts)'
  false_positive_note: "This is not a false positive \u2014 it is a critical misconfiguration. Verify\
    \ the IAM binding exists and that no VPC-SC perimeter actively rejects the allUsers principal. If\
    \ both are true, treat this as a P1 incident: any external attacker can poison every workload consuming\
    \ from {repo.name}."
  narrative: "Repository {repo.name} grants artifactregistry.repositories.uploadArtifacts to allUsers\
    \ (public internet access). Any unauthenticated attacker can push a malicious container image or package\
    \ directly into this repository, poisoning every workload that pulls from it. This is the highest-severity\
    \ supply-chain vulnerability in Artifact Registry \u2014 immediate remediation required."