Google Vertex AI SDK Vulnerability Enables Code Execution via Bucket Squatting

A vulnerability in Google's Vertex AI SDK for Python allowed attackers to hijack machine learning model uploads and execute arbitrary code within Google's infrastructure. Discovered by Palo Alto Networks' Unit 42, the flaw, termed 'Pickle in the Middle,' exploited predictable bucket naming and a lack of ownership verification. Attackers could create a bucket with the same name as a victim's expected staging bucket, leading to model uploads being redirected to the attacker's bucket. This scenario allowed the attacker to replace the model with a malicious version during a narrow time window. The exploit could lead to remote code execution due to the use of Python's pickle serialization format. Google has patched the vulnerability in SDK versions 1.144.0 and 1.148.0, urging users to update. No active exploitation has been reported in the wild.

Key Points: • Vulnerability in Google Vertex AI SDK allows model hijacking and RCE. • Attackers exploit predictable bucket names to redirect model uploads. • Google has released patches and urged users to update their SDKs.