Affected Systems
Google Vertex AI Python SDK. Affects users uploading models to Vertex AI. Vulnerability exploits bucket squatting during model upload process combined with pickle deserialization to achieve cross-tenant remote code execution.
Exploitation Status
Discovered by Unit 42 researchers. No CVE assigned yet. No public PoC available. Active exploitation status unknown. Requires attacker to predict or hijack bucket names during model upload operations.
Business Impact
Organizations using Vertex AI Python SDK for model uploads are at risk of remote code execution. Attackers can potentially execute arbitrary code in victim environments by exploiting the bucket squatting vulnerability during the upload process. Impact is cross-tenant, meaning one GCP customer could potentially compromise another. Severity is high but exploitation requires specific conditions during model upload timing and bucket name prediction.
Urgency
🟡 Within a week
Recommended Actions
- Identify all systems and pipelines using Google Vertex AI Python SDK for model uploads
- Monitor Google Cloud Storage bucket access logs for unexpected bucket creation or access patterns during model upload operations
- Review and update to the latest Vertex AI Python SDK version once Google releases a patch
- Implement additional validation of model artifacts before upload and after download from GCS buckets
- Consider using private GCS buckets with strict IAM policies and VPC Service Controls to limit bucket squatting attack surface
- Monitor for Google security advisories regarding this vulnerability and apply patches immediately when available