Vertex AI又爆坑！Python SDK上傳流程漏洞：桶名被蹭=模型被替换，还能2.5秒内下手

Google Cloud’s Vertex AI SDK for Python has a patched security flaw, and the scenario is terrifyingly practical: attackers don’t need access to the victim’s project. The root cause is a “default staging bucket” behavior during model uploads. If developers don’t explicitly set a staging storage location, older SDK versions auto-generate a bucket name based on the Google Cloud project ID and region. The SDK checks only whether the bucket name exists—not whether it actually belongs to the caller. Because bucket names are globally unique, an attacker who knows the victim’s project ID can pre-create a same-named bucket in their own cloud project. When the victim uploads, the model artifacts may land in attacker-controlled storage. Even worse: there’s a tiny time window. Unit 42 reported ~2.5 seconds between upload completion and Vertex AI’s proxy reading the file. If the attacker swaps in a malicious model during that gap (often via automated triggers), Vertex AI may deploy the tampered version. If the model is later loaded using Python serialization like pickle/joblib, arbitrary code execution becomes possible. Upgrade to Vertex AI SDK 1.148.0+ and explicitly set your own staging bucket. #CyberSecurity #GoogleCloud #VertexAI #Python #SupplyChainSecurity #Malware

Want to learn more? Visit Explore the world, stay updated on travel insights and international affairs, and discover authentic stories from real life