Vertex Gemini API Data Exfiltration Vulnerability via Custom File URI: CVE-2024-12236 December 2024

Use of Custom URI for media inputs with VPC-SC enabled potentially leads to data exfiltration
A security issue exists in Vertex Gemini API for customers using VPC-SC. By utilizing a custom crafted file URI for image input, data exfiltration is possible due to requests being routed outside the VPC-SC security perimeter, circumventing the intended security restrictions of VPC-SC. No further fix actions are needed. Google Cloud Platform implemented a fix to return an error message when a media file URL is specified in the fileUri parameter and VPC Service Controls is enabled. Other use cases are unaffected.

Vulnerability Analysis

CVE-2024-12236 is exploitable with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.

Attack Vector:

LOCAL

Attack Complexity:

LOW

Privileges Required:

LOW

User Interaction:

NONE

Weakness Type

Improper Handling of Exceptional Conditions

The software does not handle or incorrectly handles an exceptional condition.

Products Associated with CVE-2024-12236

Want to know whenever a new CVE is published for Google Vertex Gemini Api? stack.watch will email you.

Affected Versions

Exploit Probability

EPSS

0.08%

Percentile

0.25%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.