TLDR Tech / InfoSec
Google Vertex AI SDK Flaw Let Attackers Hijack Model Uploads via Bucket Squatting
A bug in the Google Cloud Vertex AI Python SDK allowed attackers to register predictable Vertex staging buckets, capture model uploads from other projects, and replace them with malicious pickle-based models that executed code in Google's serving containers. The payload in Unit 42's test stole OAuth tokens and accessed other model artifacts, logs, and metadata in the same Google-managed tenant project. Google partially fixed the issue in v1.144.0 with randomized bucket names and completed the fix in v1.148.0 with bucket ownership checks, and recommends upgrading and setting an explicit staging_bucket everywhere the SDK runs.
Read the full story